def tamper(payload, **kwargs):
"""
Replaces each (MySQL) 0x<hex> encoded string with equivalent CONCAT(CHAR(),...) counterpart
Requirement:
* MySQL
Tested against:
* MySQL 4, 5.0 and 5.5
Notes:
* Useful in cases when web application does the upper casing
>>> tamper('SELECT 0xdeadbeef')
'SELECT CONCAT(CHAR(222),CHAR(173),CHAR(190),CHAR(239))'
"""
retVal = payload
if payload:
for match in re.finditer(r"\b0x([0-9a-f]+)\b", retVal):
if len(match.group(1)) > 2:
result = "CONCAT(%s)" % ','.join(
"CHAR(%d)" % _ for _ in getOrds(decodeHex(match.group(1))))
else:
result = "CHAR(%d)" % ord(decodeHex(match.group(1)))
retVal = retVal.replace(match.group(0), result)
return retVal
def escaper(value):
return "&".join("CHR(%d)" % _ for _ in getOrds(value))
def escaper(value):
return "+".join("%s(%d)" % ("CHAR" if _ < 128 else "NCHAR", _) for _ in getOrds(value))
def escaper(value):
return "||".join("CODE(%d)" % _ for _ in getOrds(value))
def escaper(value):
return "(%s)" % "||".join("CHR(%d)" % _ for _ in getOrds(value)) # Postgres CHR() function already accepts Unicode code point of character(s)
def escaper(value):
return "||".join("UNICODE_CHAR(%d)" % _ for _ in getOrds(value))
def escaper(value):
return "||".join("ASCII_CHAR(%d)" % _ for _ in getOrds(value))
def escaper(value):
if all(_ < 128 for _ in getOrds(value)):
# return "0x%s" % getUnicode(binascii.hexlify(getBytes(value)))
return "%s" % value
else:
return "CONVERT(0x%s USING utf8)" % getUnicode(binascii.hexlify(getBytes(value, "utf8")))
def escaper(value):
return "CHAR(%s)" % ','.join("%d" % _ for _ in getOrds(value))
