Different Encoding techniques

[pntf]

Modification to include homoglphys and different types of encoding, namely unicode to bypass older filters.
Additionally checks for recursive filters, such as SELSELECTECT that would remove select but still be vulnerable.

[stamparm]

@pntf you'll have to be more specific. We can add new tamper script for recursive filters for sure, but you have to explain this one "different types of encoding, namely unicode to bypass older filters"

we already have tampering scripts for few encodings:

A) --tamper=charunicodeencode.py
input: SELECT FIELD FROM TABLE
output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045

B) --tamper=chardoubleencode.py
input: SELECT FIELD FROM TABLE
output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545

C) --tamper=charencode.py
input: SELECT FIELD FROM TABLE
output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

[pntf]

Miroslav,
First off, great software. It helps us on our internal tests daily.
What I was referring to was homoglphys.
Example – If the filter looks for semi colons and removes them, it may be possible to use unicode

on some server %u236E gets translated to semicolon when passed to the actual SQL server.
For single quote, we have had luck on these bypassing filters as well:
%u0027
%u02b9
%u02bc
%u02c8
%u2032
%uff07
%c0%27
%c0%a7
%e0%80%a7

As for the recursive. Some filters look for keywords, but not recursively. So a SELSELECTECT string would be sanitized to SELECT. If the filter replaces the keyword with a space, then SEL/SELECT/ECT would work there.
Does that make sense?

From: Miroslav Stampar
Sent: Friday, August 24, 2012 3:29 AM
To: sqlmapproject/sqlmap
Cc: pntf
Subject: Re: [sqlmap] Different Encoding techniques (#163)

@pntf you'll have to be more specific. We can add new tamper script for recursive filters for sure, but you have to explain this one "different types of encoding, namely unicode to bypass older filters"

we already have tampering scripts for couple of encoding types:

A) --tamper=charunicodeencode.py
input: SELECT FIELD FROM TABLE
output: %u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045

B) --tamper=chardoubleencode.py
input: SELECT FIELD FROM TABLE
output: %2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545

C) --tamper=charencode.py
input: SELECT FIELD FROM TABLE
output: %53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

—
Reply to this email directly or view it on GitHub.

[stamparm]

Hi.

It makes sense. We will make tamper script for sure for those recursive
cases.

But, as of homoglphys. It's kind of difficult to make anything "automatic"
when there are lots of choices to be made. Especially, if that's something
that is too specific. We can make a tamper script for that too, but we
can't make one script for all, neither we can make 10 scripts for 10 of
those. Do you have some sane idea how to deal with those?

Kind regards

On Fri, Aug 24, 2012 at 4:06 PM, pntf notifications@github.com wrote:

Miroslav,
First off, great software. It helps us on our internal tests daily.
What I was referring to was homoglphys.
Example – If the filter looks for semi colons and removes them, it may be
possible to use unicode

on some server %u236E gets translated to semicolon when passed to the
actual SQL server.
For single quote, we have had luck on these bypassing filters as well:
%u0027
%u02b9
%u02bc
%u02c8
%u2032
%uff07
%c0%27
%c0%a7
%e0%80%a7

As for the recursive. Some filters look for keywords, but not recursively.
So a SELSELECTECT string would be sanitized to SELECT. If the filter
replaces the keyword with a space, then SEL/SELECT/ECT would work there.
Does that make sense?

From: Miroslav Stampar
Sent: Friday, August 24, 2012 3:29 AM
To: sqlmapproject/sqlmap
Cc: pntf
Subject: Re: [sqlmap] Different Encoding techniques (#163)

@pntf you'll have to be more specific. We can add new tamper script for
recursive filters for sure, but you have to explain this one "different
types of encoding, namely unicode to bypass older filters"

we already have tampering scripts for couple of encoding types:

A) --tamper=charunicodeencode.py
input: SELECT FIELD FROM TABLE
output:
%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045

B) --tamper=chardoubleencode.py
input: SELECT FIELD FROM TABLE
output:
%2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545

C) --tamper=charencode.py
input: SELECT FIELD FROM TABLE
output:
%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

—
Reply to this email directly or view it on GitHub.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/163#issuecomment-8002247.

Miroslav Stampar
http://about.me/stamparm

[stamparm]

"If the filter replaces the keyword with a space, then SEL/SELECT/ECT
would work there. "
It's a common missbelief that things like SELE/**/CT works. It doesn't :).
MySQL itself interprets inline comments with space :)

On Sun, Aug 26, 2012 at 4:02 PM, Miroslav Stampar <
miroslav.stampar@gmail.com> wrote:

Hi.

It makes sense. We will make tamper script for sure for those recursive
cases.

But, as of homoglphys. It's kind of difficult to make anything "automatic"
when there are lots of choices to be made. Especially, if that's something
that is too specific. We can make a tamper script for that too, but we
can't make one script for all, neither we can make 10 scripts for 10 of
those. Do you have some sane idea how to deal with those?

Kind regards

On Fri, Aug 24, 2012 at 4:06 PM, pntf notifications@github.com wrote:

Miroslav,
First off, great software. It helps us on our internal tests daily.
What I was referring to was homoglphys.
Example – If the filter looks for semi colons and removes them, it may be
possible to use unicode

on some server %u236E gets translated to semicolon when passed to the
actual SQL server.
For single quote, we have had luck on these bypassing filters as well:
%u0027
%u02b9
%u02bc
%u02c8
%u2032
%uff07
%c0%27
%c0%a7
%e0%80%a7

As for the recursive. Some filters look for keywords, but not
recursively. So a SELSELECTECT string would be sanitized to SELECT. If the
filter replaces the keyword with a space, then SEL/SELECT/ECT would work
there.
Does that make sense?

From: Miroslav Stampar
Sent: Friday, August 24, 2012 3:29 AM
To: sqlmapproject/sqlmap
Cc: pntf
Subject: Re: [sqlmap] Different Encoding techniques (#163)

@pntf you'll have to be more specific. We can add new tamper script for
recursive filters for sure, but you have to explain this one "different
types of encoding, namely unicode to bypass older filters"

we already have tampering scripts for couple of encoding types:

A) --tamper=charunicodeencode.py
input: SELECT FIELD FROM TABLE
output:
%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045

B) --tamper=chardoubleencode.py
input: SELECT FIELD FROM TABLE
output:
%2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545

C) --tamper=charencode.py
input: SELECT FIELD FROM TABLE
output:
%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

—
Reply to this email directly or view it on GitHub.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/163#issuecomment-8002247.

Miroslav Stampar
http://about.me/stamparm

Miroslav Stampar
http://about.me/stamparm

[pntf]

Hi,
I was working on a tamper script that just had a loop to replace certain characters with known homoglyphs. What about running through from %u0000 to %u9999?
Also, does sqlmap support xml posts? I have a raw post I am passing in as data that is standard XML format, but it doesn’t seem to understand it.

Thanks!

From: Miroslav Stampar
Sent: Sunday, August 26, 2012 10:02 AM
To: sqlmapproject/sqlmap
Cc: pntf
Subject: Re: [sqlmap] Different Encoding techniques (#163)

Hi.

It makes sense. We will make tamper script for sure for those recursive
cases.

But, as of homoglphys. It's kind of difficult to make anything "automatic"
when there are lots of choices to be made. Especially, if that's something
that is too specific. We can make a tamper script for that too, but we
can't make one script for all, neither we can make 10 scripts for 10 of
those. Do you have some sane idea how to deal with those?

Kind regards

On Fri, Aug 24, 2012 at 4:06 PM, pntf notifications@github.com wrote:

Miroslav,
First off, great software. It helps us on our internal tests daily.
What I was referring to was homoglphys.
Example – If the filter looks for semi colons and removes them, it may be
possible to use unicode

on some server %u236E gets translated to semicolon when passed to the
actual SQL server.
For single quote, we have had luck on these bypassing filters as well:
%u0027
%u02b9
%u02bc
%u02c8
%u2032
%uff07
%c0%27
%c0%a7
%e0%80%a7

As for the recursive. Some filters look for keywords, but not recursively.
So a SELSELECTECT string would be sanitized to SELECT. If the filter
replaces the keyword with a space, then SEL/SELECT/ECT would work there.
Does that make sense?

From: Miroslav Stampar
Sent: Friday, August 24, 2012 3:29 AM
To: sqlmapproject/sqlmap
Cc: pntf
Subject: Re: [sqlmap] Different Encoding techniques (#163)

@pntf you'll have to be more specific. We can add new tamper script for
recursive filters for sure, but you have to explain this one "different
types of encoding, namely unicode to bypass older filters"

we already have tampering scripts for couple of encoding types:

A) --tamper=charunicodeencode.py
input: SELECT FIELD FROM TABLE
output:
%u0053%u0045%u004c%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004c%u0044%u0020%u0046%u0052%u004f%u004d%u0020%u0054%u0041%u0042%u004c%u0045

B) --tamper=chardoubleencode.py
input: SELECT FIELD FROM TABLE
output:
%2553%2545%254c%2545%2543%2554%2520%2546%2549%2545%254c%2544%2520%2546%2552%254f%254d%2520%2554%2541%2542%254c%2545

C) --tamper=charencode.py
input: SELECT FIELD FROM TABLE
output:
%53%45%4c%45%43%54%20%46%49%45%4c%44%20%46%52%4f%4d%20%54%41%42%4c%45

—
Reply to this email directly or view it on GitHub.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/163#issuecomment-8002247.

Miroslav Stampar
http://about.me/stamparm
—
Reply to this email directly or view it on GitHub.

[stamparm]

Use --tamper=nonrecursivereplacement for those recursive cases (currently keywords being processed are: "UNION", "SELECT", "INSERT", "UPDATE", "FROM", "WHERE"). You can freely update the list by editing that same tamper script inside /tamper directory. As of homoglphys, it's futile to do a single tamper script per each. That should be left to the end user.