diff --git a/lib/core/option.py b/lib/core/option.py index 243e98c10..3224f6edc 100644 --- a/lib/core/option.py +++ b/lib/core/option.py @@ -835,7 +835,7 @@ def __setTamperingFunctions(): priority = PRIORITY.NORMAL if not hasattr(module, '__priority__') else module.__priority__ for name, function in inspect.getmembers(module, inspect.isfunction): - if name == "tamper" and function.func_code.co_argcount == 2: + if name == "tamper": found = True kb.tamperFunctions.append(function) function.func_name = module.__name__ diff --git a/tamper/apostrophemask.py b/tamper/apostrophemask.py index dd06afe67..712a6f9ca 100644 --- a/tamper/apostrophemask.py +++ b/tamper/apostrophemask.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.LOWEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces apostrophe character with its UTF-8 full width counterpart diff --git a/tamper/apostrophenullencode.py b/tamper/apostrophenullencode.py index f7864a8c4..a4a0f6b08 100644 --- a/tamper/apostrophenullencode.py +++ b/tamper/apostrophenullencode.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.LOWEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces apostrophe character with its illegal double unicode counterpart diff --git a/tamper/appendnullbyte.py b/tamper/appendnullbyte.py index 9eee21d1e..cd5a2649b 100644 --- a/tamper/appendnullbyte.py +++ b/tamper/appendnullbyte.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.LOWEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Appends encoded NULL byte character at the end of payload diff --git a/tamper/base64encode.py b/tamper/base64encode.py index c76fde99f..98c980c84 100644 --- a/tamper/base64encode.py +++ b/tamper/base64encode.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.LOWEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Base64 all characters in a given payload diff --git a/tamper/between.py b/tamper/between.py index 619348b85..18ef3e9f7 100644 --- a/tamper/between.py +++ b/tamper/between.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.HIGHEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' diff --git a/tamper/bluecoat.py b/tamper/bluecoat.py index be6f375b0..0e1829683 100644 --- a/tamper/bluecoat.py +++ b/tamper/bluecoat.py @@ -17,7 +17,7 @@ __priority__ = PRIORITY.NORMAL def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character after SQL statement with a valid random blank character. Afterwards replace character = with LIKE operator diff --git a/tamper/chardoubleencode.py b/tamper/chardoubleencode.py index 35ac1a8aa..14dce2592 100644 --- a/tamper/chardoubleencode.py +++ b/tamper/chardoubleencode.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.LOW def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Double url-encodes all characters in a given payload (not processing already encoded) diff --git a/tamper/charencode.py b/tamper/charencode.py index 1137f01b2..b9569542c 100644 --- a/tamper/charencode.py +++ b/tamper/charencode.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.LOWEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Url-encodes all characters in a given payload (not processing already encoded) diff --git a/tamper/charunicodeencode.py b/tamper/charunicodeencode.py index 71d0eb2bc..4f31f0e8c 100644 --- a/tamper/charunicodeencode.py +++ b/tamper/charunicodeencode.py @@ -16,7 +16,7 @@ __priority__ = PRIORITY.LOWEST def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against ASP or ASP.NET web applications" % os.path.basename(__file__).split(".")[0]) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Unicode-url-encodes non-encoded characters in a given payload (not processing already encoded) diff --git a/tamper/equaltolike.py b/tamper/equaltolike.py index 07cb2cdba..85d9385d1 100644 --- a/tamper/equaltolike.py +++ b/tamper/equaltolike.py @@ -17,7 +17,7 @@ __priority__ = PRIORITY.HIGHEST def dependencies(): singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" % (os.path.basename(__file__).split(".")[0], DBMS.PGSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces all occurances of operator equal ('=') with operator 'LIKE' diff --git a/tamper/halfversionedmorekeywords.py b/tamper/halfversionedmorekeywords.py index f98d665c1..381a35d49 100644 --- a/tamper/halfversionedmorekeywords.py +++ b/tamper/halfversionedmorekeywords.py @@ -19,7 +19,7 @@ __priority__ = PRIORITY.HIGHER def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s < 5.1" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Adds versioned MySQL comment before each keyword diff --git a/tamper/ifnull2ifisnull.py b/tamper/ifnull2ifisnull.py index ca798da7e..ad84fdfc0 100644 --- a/tamper/ifnull2ifisnull.py +++ b/tamper/ifnull2ifisnull.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.HIGHEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' diff --git a/tamper/modsecurityversioned.py b/tamper/modsecurityversioned.py index 8e77433e8..8c5a1121e 100644 --- a/tamper/modsecurityversioned.py +++ b/tamper/modsecurityversioned.py @@ -13,7 +13,7 @@ __priority__ = PRIORITY.HIGHER def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Embraces complete query with versioned comment diff --git a/tamper/modsecurityzeroversioned.py b/tamper/modsecurityzeroversioned.py index 0886c86ac..d839736b5 100644 --- a/tamper/modsecurityzeroversioned.py +++ b/tamper/modsecurityzeroversioned.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.HIGHER def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Embraces complete query with zero-versioned comment diff --git a/tamper/multiplespaces.py b/tamper/multiplespaces.py index f7eaac6ed..718762896 100644 --- a/tamper/multiplespaces.py +++ b/tamper/multiplespaces.py @@ -16,7 +16,7 @@ __priority__ = PRIORITY.NORMAL def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Adds multiple spaces around SQL keywords diff --git a/tamper/nonrecursivereplacement.py b/tamper/nonrecursivereplacement.py index 3c0049c84..efc9c83df 100644 --- a/tamper/nonrecursivereplacement.py +++ b/tamper/nonrecursivereplacement.py @@ -13,7 +13,7 @@ from lib.core.enums import PRIORITY __priority__ = PRIORITY.NORMAL -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces predefined SQL keywords with representations suitable for replacement (e.g. .replace("SELECT", "")) filters diff --git a/tamper/percentage.py b/tamper/percentage.py index d1ebe183f..14235cf7e 100644 --- a/tamper/percentage.py +++ b/tamper/percentage.py @@ -16,7 +16,7 @@ __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against ASP web applications" % os.path.basename(__file__).split(".")[0]) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Adds a percentage sign ('%') infront of each character diff --git a/tamper/randomcase.py b/tamper/randomcase.py index 8685eb683..de6e4cfbe 100644 --- a/tamper/randomcase.py +++ b/tamper/randomcase.py @@ -16,7 +16,7 @@ __priority__ = PRIORITY.NORMAL def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces each keyword character with random case value diff --git a/tamper/randomcomments.py b/tamper/randomcomments.py index 6700ff448..50e455a1e 100644 --- a/tamper/randomcomments.py +++ b/tamper/randomcomments.py @@ -13,7 +13,7 @@ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Add random comments to SQL keywords Example: 'INSERT' becomes 'IN/**/S/**/ERT' diff --git a/tamper/securesphere.py b/tamper/securesphere.py index 17755a51e..a6755a25a 100644 --- a/tamper/securesphere.py +++ b/tamper/securesphere.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.NORMAL def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Appends special crafted string diff --git a/tamper/sp_password.py b/tamper/sp_password.py index 7f35ba169..00912ea31 100644 --- a/tamper/sp_password.py +++ b/tamper/sp_password.py @@ -9,7 +9,7 @@ from lib.core.enums import PRIORITY __priority__ = PRIORITY.HIGH -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Appends 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs diff --git a/tamper/space2comment.py b/tamper/space2comment.py index 13392f072..e3bb6fe46 100644 --- a/tamper/space2comment.py +++ b/tamper/space2comment.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.LOW def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with comments '/**/' diff --git a/tamper/space2dash.py b/tamper/space2dash.py index acbb69cde..e70b62c61 100644 --- a/tamper/space2dash.py +++ b/tamper/space2dash.py @@ -12,7 +12,7 @@ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a dash comment ('--') followed by a random string and a new line ('\n') diff --git a/tamper/space2hash.py b/tamper/space2hash.py index a80c43b5c..3a423415c 100644 --- a/tamper/space2hash.py +++ b/tamper/space2hash.py @@ -18,7 +18,7 @@ __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') diff --git a/tamper/space2morehash.py b/tamper/space2morehash.py index 55937a7a8..99491516c 100644 --- a/tamper/space2morehash.py +++ b/tamper/space2morehash.py @@ -21,7 +21,7 @@ __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s > 5.1.13" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') diff --git a/tamper/space2mssqlblank.py b/tamper/space2mssqlblank.py index 8658e276e..67e15deaa 100644 --- a/tamper/space2mssqlblank.py +++ b/tamper/space2mssqlblank.py @@ -17,7 +17,7 @@ __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MSSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a random blank character from a valid set of alternate characters diff --git a/tamper/space2mssqlhash.py b/tamper/space2mssqlhash.py index 0d3602aba..d9aa81149 100644 --- a/tamper/space2mssqlhash.py +++ b/tamper/space2mssqlhash.py @@ -9,7 +9,7 @@ from lib.core.enums import PRIORITY __priority__ = PRIORITY.LOW -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a pound character ('#') followed by a new line ('\n') diff --git a/tamper/space2mysqlblank.py b/tamper/space2mysqlblank.py index e0ea098eb..f04eadb43 100644 --- a/tamper/space2mysqlblank.py +++ b/tamper/space2mysqlblank.py @@ -17,7 +17,7 @@ __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a random blank character from a valid set of alternate characters diff --git a/tamper/space2mysqldash.py b/tamper/space2mysqldash.py index 00a3d9a29..c2870f5fb 100644 --- a/tamper/space2mysqldash.py +++ b/tamper/space2mysqldash.py @@ -16,7 +16,7 @@ __priority__ = PRIORITY.LOW def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a dash comment ('--') followed by a new line ('\n') diff --git a/tamper/space2plus.py b/tamper/space2plus.py index 2497e460c..11787e1ad 100644 --- a/tamper/space2plus.py +++ b/tamper/space2plus.py @@ -12,7 +12,7 @@ __priority__ = PRIORITY.LOW def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with plus ('+') diff --git a/tamper/space2randomblank.py b/tamper/space2randomblank.py index 0b410dc63..6244c1334 100644 --- a/tamper/space2randomblank.py +++ b/tamper/space2randomblank.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.LOW def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces space character (' ') with a random blank character from a valid set of alternate characters diff --git a/tamper/unionalltounion.py b/tamper/unionalltounion.py index 1dd6cda11..1f8b3c710 100644 --- a/tamper/unionalltounion.py +++ b/tamper/unionalltounion.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.HIGHEST def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces UNION ALL SELECT with UNION SELECT diff --git a/tamper/unmagicquotes.py b/tamper/unmagicquotes.py index 4b884f276..4d75e2a8d 100644 --- a/tamper/unmagicquotes.py +++ b/tamper/unmagicquotes.py @@ -14,7 +14,7 @@ __priority__ = PRIORITY.NORMAL def dependencies(): pass -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Replaces quote character (') with a multi-byte combo %bf%27 together with generic comment at the end (to make it work) diff --git a/tamper/versionedkeywords.py b/tamper/versionedkeywords.py index 8c6437b24..f5d9852de 100644 --- a/tamper/versionedkeywords.py +++ b/tamper/versionedkeywords.py @@ -18,7 +18,7 @@ __priority__ = PRIORITY.HIGHER def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Encloses each non-function keyword with versioned MySQL comment diff --git a/tamper/versionedmorekeywords.py b/tamper/versionedmorekeywords.py index ac7821daf..956c5376d 100644 --- a/tamper/versionedmorekeywords.py +++ b/tamper/versionedmorekeywords.py @@ -19,7 +19,7 @@ __priority__ = PRIORITY.HIGHER def dependencies(): singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s >= 5.1.13" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL)) -def tamper(payload, headers=None): +def tamper(payload, **kwargs): """ Encloses each keyword with versioned MySQL comment