Update of a doc/THANKS

stamparm · stamparm · commit 90daef0b9c80 · 2013-01-25T10:27:57.000+01:00
diff --git a/doc/THANKS.md b/doc/THANKS.md
@@ -116,6 +116,9 @@ Carey Evans, <careye@spamcop.net>
 * for his fcrypt module that allows crypt(3) support
     on Windows platforms
 
+Shawn Evans, <shawndevans@gmail.com>
+* for suggesting an idea for one tamper script, greatest.py
+
 Adam Faheem, <faheem.adam@is.co.za>
 * for reporting a few bugs
 
@@ -294,7 +297,7 @@ Michael Majchrowicz, <mmajchrowicz@gmail.com>
 * for suggesting a lot of ideas and features
 
 Ahmad Maulana, <matdhule@gmail.com>
-* for contributing one tamper scripts, halfversionedmorekeywords.py
+* for contributing one tamper script, halfversionedmorekeywords.py
 
 Ferruh Mavituna, <ferruh@mavituna.com>
 * for exchanging ideas on the implementation of a couple of features
diff --git a/tamper/greatest.py b/tamper/greatest.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2013 sqlmap developers (http://sqlmap.org/)
+See the file 'doc/COPYING' for copying permission
+"""
+
+import re
+
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.HIGHEST
+
+def dependencies():
+    pass
+
+def tamper(payload, **kwargs):
+    """
+    Replaces greater than operator ('>') with 'GREATEST' counterpart
+
+    Example:
+        * Input: 'A > B'
+        * Output: 'GREATEST(A, B + 1) = A'
+
+    Tested against:
+        * MySQL 4, 5.0 and 5.5
+        * Oracle 10g
+        * PostgreSQL 8.3, 8.4, 9.0
+
+    Notes:
+        * Useful to bypass weak and bespoke web application firewalls that
+          filter the greater than character
+        * The GREATEST clause is a widespread SQL command. Hence, this
+          tamper script should work against majority of databases
+    """
+
+    retVal = payload
+
+    if payload:
+        match = re.search(r"(?i)(\b(AND|OR)\b\s+)(?!.*\b(AND|OR)\b)([^>]+?)\s*>\s*([\d(+\-*/)]+)\s*\Z", payload)
+
+        if match:
+            _ = "%sGREATEST(%s,%s+1)=%s" % (match.group(1), match.group(4), match.group(5), match.group(4))
+            retVal = retVal.replace(match.group(0), _)
+
+    return retVal
