def tamper(payload, **kwargs):
"""
Replaces each (MySQL) 0x<hex> encoded string with equivalent CONCAT(CHAR(),...) counterpart
Requirement:
* MySQL
Tested against:
* MySQL 4, 5.0 and 5.5
Notes:
* Useful in cases when web application does the upper casing
>>> tamper('SELECT 0xdeadbeef')
'SELECT CONCAT(CHAR(222),CHAR(173),CHAR(190),CHAR(239))'
"""
retVal = payload
if payload:
for match in re.finditer(r"\b0x([0-9a-f]+)\b", retVal):
if len(match.group(1)) > 2:
result = "CONCAT(%s)" % ','.join("CHAR(%d)" % _ for _ in getOrds(decodeHex(match.group(1))))
else:
result = "CHAR(%d)" % ord(decodeHex(match.group(1)))
retVal = retVal.replace(match.group(0), result)
return retVal
def escaper(value):
return "||".join("CHR(%d)" % _ for _ in getOrds(value))
def escaper(value):
return "(%s)" % "||".join("CHR(%d)" % _ for _ in getOrds(value)) # Postgres CHR() function already accepts Unicode code point of character(s)
def escaper(value):
return "||".join("%s(%d)" % ("CHR" if _ < 128 else "NCHR", _)
for _ in getOrds(value))
def escaper(value):
if all(_ < 128 for _ in getOrds(value)):
return "0x%s" % getUnicode(binascii.hexlify(getBytes(value)))
else:
return "CONVERT(0x%s USING utf8)" % getUnicode(binascii.hexlify(getBytes(value)))
def escaper(value):
return "+".join("%s(%d)" % ("CHAR" if _ < 128 else "TO_UNICHAR", _)
for _ in getOrds(value))