Sqlmap supports multiple ways to process parameters with custom code. You can use
--eval to base64-encode a single parameter, like so:
--eval "import base64; paramname = base64.b64encode(paramname)"
Also, you can use the
--tamper parameter to load a custom python script that modifies the payload.
Unfortunately it's not straightforward to tamper with the entire POST query string. But here is a suggestion for a workaround:
Specify an empty data string in your sqlmap command (use the asterisk (
*) to indicate the injection point) and declare a
$ ./sqlmap.py -u "http://example.com/" --data "*" --method POST --tamper mytamper
The tamper script could look like this:
def tamper(payload, **kwargs):
params = 'name1=value1%s&name2=value2' % payload
data = urllib.quote_plus(params)
data = base64.b64encode(data)
This script inserts the payload into your query and performs the URL-encoding and base64 conversions. It currently tests for the
name1 parameter. You would have to change the injection point manually if you want to check the other one.
For the sample payload
) AND 3825=3825 AND (7759=7759 you would end up with a request like this:
POST / HTTP/1.1
User-agent: sqlmap/1.0-dev-6fef294 (http://sqlmap.org)
Content-type: application/x-www-form-urlencoded; charset=utf-8
As you can see the POST body is URL- and base64-encoded.