Update for an Issue #835

stamparm · stamparm · commit 46480d777ad9 · 2014-09-20T14:48:36.000+02:00
diff --git a/doc/THANKS.md b/doc/THANKS.md
@@ -226,6 +226,9 @@ Daniel Huckmann, <sanitybit@gmail.com>
 Daliev Ilya, <daliser@yandex.ru>
 * for reporting a bug
 
+Mehmet İnce, <mehmet@mehmetince.net>
+* for contributing a tamper script xforwardedfor.py
+
 Jovon Itwaru, <jovon.itwaru@gmail.com>
 * for reporting a minor bug
 
diff --git a/tamper/randomfakeproxy.py b/tamper/randomfakeproxy.py
diff --git a/tamper/varnish.py b/tamper/varnish.py
@@ -14,7 +14,7 @@ def dependencies():
 
 def tamper(payload, **kwargs):
     """
-    Append a HTTP Request Parameter to bypass
+    Append a HTTP header 'X-originating-IP' to bypass
     WAF Protection of Varnish Firewall
 
     Notes:
diff --git a/tamper/xforwardedfor.py b/tamper/xforwardedfor.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2014 sqlmap developers (http://sqlmap.org/)
+See the file 'doc/COPYING' for copying permission
+"""
+
+from lib.core.enums import PRIORITY
+from random import sample
+__priority__ = PRIORITY.NORMAL
+
+def dependencies():
+    pass
+
+def randomIP():
+    numbers = []
+    while not numbers or numbers[0] in (10, 172, 192):
+        numbers = sample(xrange(1, 255), 4)
+    return '.'.join(str(_) for _ in numbers)
+
+def tamper(payload, **kwargs):
+    """
+    Append a fake HTTP header 'X-Forwarded-For' to bypass
+    WAF (usually application based) protection
+    """
+
+    headers = kwargs.get("headers", {})
+    headers["X-Forwarded-For"] = randomIP()
+    return payload

-Original file line number
+Diff line change
 Daliev Ilya, <[email protected]>
 * for reporting a bug
 +Mehmet İnce, <[email protected]>
 +* for contributing a tamper script xforwardedfor.py
++
 Jovon Itwaru, <[email protected]>
 * for reporting a minor bug