Adding new tamper script (Issue #1247)

stamparm · stamparm · commit 5ce3306114e7 · 2015-09-13T14:47:27.000+02:00
diff --git a/tamper/uppercase.py b/tamper/uppercase.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2015 sqlmap developers (http://sqlmap.org/)
+See the file 'doc/COPYING' for copying permission
+"""
+
+import re
+
+from lib.core.data import kb
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.NORMAL
+
+def dependencies():
+    pass
+
+def tamper(payload, **kwargs):
+    """
+    Replaces each keyword character with upper case value
+
+    Tested against:
+        * Microsoft SQL Server 2005
+        * MySQL 4, 5.0 and 5.5
+        * Oracle 10g
+        * PostgreSQL 8.3, 8.4, 9.0
+
+    Notes:
+        * Useful to bypass very weak and bespoke web application firewalls
+          that has poorly written permissive regular expressions
+        * This tamper script should work against all (?) databases
+
+    >>> tamper('insert')
+    'INSERT'
+    """
+
+    retVal = payload
+
+    if payload:
+        for match in re.finditer(r"[A-Za-z_]+", retVal):
+            word = match.group()
+
+            if word.upper() in kb.keywords:
+                retVal = retVal.replace(word, word.upper())
+
+    return retVal
