Sqlmap темпер

Discussion in 'Песочница' started by Poertorikanec, 7 May 2023.

  1. Poertorikanec

    Poertorikanec New Member

    Joined:
    29 Apr 2023
    Messages:
    2
    Likes Received:
    0
    Reputations:
    0
    Ребята такой вопрос, если Whatwaf показывает 5 темперов, а в Sqlmap есть только один из этих пяти, как быть?
    не могу открыть dbs

    (#1) description: tamper payload by adding random junk characters into the payload to bypass regex based protection
    example: '<?\[-\,;,];|~script>!!(#|.[)_)`|alert('1');<_`\`;)$)(?;/script>_&^$~$*(!+,%%`'
    load path: content.tampers.randomjunkcharacters

    (#2) description: tamper payload by replacing the spaces in the payload with either the tab character or eight spaces
    example: 'SELECT\tuser FROM information_schema.tables AND user\t= 'test\tuser';'
    load path: content.tampers.randomtabify

    (#3) description: tamper payload by changing the spaces in the payload into a comment
    example: '484029")/**/AS/**/xDKy/**/WHERE/**/5427=5427/**/UNION/**/ALL/**/SELECT/**/NULL,NULL'
    load path: content.tampers.space2comment

    (#4) description: tamper payload by add decoy tags to the script
    example: '<xanxss><script><xanxss>alert(1);<decoy></script>'
    load path: content.tampers.randomdecoys

    (#5) description: tamper payload by encoding all characters in the payload into their URL encoding equivalent
    example: '%83%69%76%69%67%84%32%42%32%70%82%79%77%32%105%110%102%111%114%109%97%116%105%111%110%95%115%99%104%101%109%97%46%116%97%98%108%101%115'
    load path: content.tampers.urlencodeall
     
  2. TrueCryptoMan

    TrueCryptoMan New Member

    Joined:
    15 May 2023
    Messages:
    12
    Likes Received:
    2
    Reputations:
    1
    Засунь в бурп узнай , что фильтруется и гугли bypass , а потом попроси chat gpt написать свой tamper