编写简单tamper绕过encode编码

&classcode="+classcode+"&keyName="+encodeURI(encodeURI(keyName)));

#!/usr/bin/env python



"""

Copyright (c) 2006-2016 sqlmap developers ([url]http://sqlmap.org/[/url])

See the file 'doc/COPYING' for copying permission

"""



import re

from urllib import quote

from lib.core.data import kb

from lib.core.enums import PRIORITY



__priority__ = PRIORITY.NORMAL



def dependencies():

    pass



def tamper(payload, **kwargs):

    """

    Replaces each keyword character with lower case value



    Tested against:

        * Microsoft SQL Server 2005

        * MySQL 4, 5.0 and 5.5

        * Oracle 10g

        * PostgreSQL 8.3, 8.4, 9.0



    Notes:

        * Useful to bypass very weak and bespoke web application firewalls

          that has poorly written permissive regular expressions

        * This tamper script should work against all (?) databases



    >>> tamper('INSERT')

    'insert'

    """



    retVal = payload

    retVal = quote(quote(retVal))



        

    return retVal