Skip to content
BackEsc
Sign in

SQL Injection · passage 178 of 186

SQLmap: Default Tamper Scripts

1 code block · SQL Injection/SQLmap.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

A tamper script is a script that modifies the SQL injection payloads to evade detection by WAFs or other security mechanisms. SQLmap comes with a variety of pre-built tamper scripts that can be used to automatically adjust payloads

sqlmap -u "http://targetwebsite.com/vulnerablepage.php?id=1" --tamper=<tamper-script-name>

Below is a table highlighting some of the most commonly used tamper scripts: | Tamper | Description | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | 0x2char.py | Replaces each (MySQL) 0xHEX encoded string with equivalent CONCAT(CHAR(),…) counterpart | | apostrophemask.py | Replaces apostrophe character with its UTF-8 full width counterpart | | apostrophenullencode.py | Replaces apostrophe character with its illegal double unicode counterpart | | appendnullbyte.py | Appends encoded NULL byte character at the end of payload | | base64encode.py | Base64 all characters in a given payload | | between.py | Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' | | bluecoat.py | Replaces space character after SQL statement with a valid random blank character.Afterwards replace character = with LIKE operator | | chardoubleencode.py | Double url-encodes all characters in a given payload (not processing already encoded) | | charencode.py | URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %53%45%4C%45%43%54) | | charunicodeencode.py | Unicode-URL-encodes all characters in a given payload (not processing already encoded) (e.g. SELECT -> %u0053%u0045%u004C%u0045%u0043%u0054) | | charunicodeescape.py | Unicode-escapes non-encoded characters in a given payload (not processing already encoded) (e.g. SELECT -> \u0053\u0045\u004C\u0045\u0043\u0054) | | commalesslimit.py | Replaces instances like 'LIMIT M, N' with 'LIMIT N OFFSET M' | | commalessmid.py | Replaces instances like 'MID(A, B, C)' with 'MID(A FROM B FOR C)' | | commentbeforeparentheses.py | Prepends (inline) comment before parentheses (e.g. ( -> /**/() | | concat2concatws.py | Replaces instances like 'CONCAT(A, B)' with 'CONCAT_WS(MID(CHAR(0), 0, 0), A, B)' | | charencode.py | Url-encodes all characters in a given payload (not processing already encoded) | | charunicodeencode.py | Unicode-url-encodes non-encoded characters in a given payload (not processing already encoded) | | equaltolike.py | Replaces all occurrences of operator equal ('=') with operator 'LIKE' | | escapequotes.py | Slash escape quotes (' and ") | | greatest.py | Replaces greater than operator ('>') with 'GREATEST' counterpart | | halfversionedmorekeywords.py | Adds versioned MySQL comment before each keyword | | htmlencode.py | HTML encode (using code points) all non-alphanumeric characters (e.g. ' -> &#39;) | | ifnull2casewhenisnull.py | Replaces instances like 'IFNULL(A, B)' with 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' counterpart | | ifnull2ifisnull.py | Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' | | informationschemacomment.py | Add an inline comment (/**/) to the end of all occurrences of (MySQL) "information_schema" identifier | | least.py | Replaces greater than operator ('>') with 'LEAST' counterpart | | lowercase.py | Replaces each keyword character with lower case value (e.g. SELECT -> select) | | modsecurityversioned.py | Embraces complete query with versioned comment | | modsecurityzeroversioned.py | Embraces complete query with zero-versioned comment | | multiplespaces.py | Adds multiple spaces around SQL keywords | | nonrecursivereplacement.py | Replaces predefined SQL keywords with representations suitable for replacement (e.g. .replace("SELECT", "")) filters | | overlongutf8.py | Converts all characters in a given payload (not processing already encoded) | | overlongutf8more.py | Converts all characters in a given payload to overlong UTF8 (not processing already encoded) (e.g. SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94) | | percentage.py | Adds a percentage sign ('%') infront of each character | | plus2concat.py | Replaces plus operator ('+') with (MsSQL) function CONCAT() counterpart | | plus2fnconcat.py | Replaces plus operator ('+') with (MsSQL) ODBC function {fn CONCAT()} counterpart | | randomcase.py | Replaces each keyword character with random case value | | randomcomments.py | Add random comments to SQL keywords | | securesphere.py | Appends special crafted string | | sp_password.py | Appends 'sp_password' to the end of the payload for automatic obfuscation from DBMS logs | | space2comment.py | Replaces space character (' ') with comments | | space2dash.py | Replaces space character (' ') with a dash comment ('--') followed by a random string and a new line ('\n') | | space2hash.py | Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') | | space2morehash.py | Replaces space character (' ') with a pound character ('#') followed by a random string and a new line ('\n') | | space2mssqlblank.py | Replaces space character (' ') with a random blank character from a valid set of alternate characters | | space2mssqlhash.py | Replaces space character (' ') with a pound character ('#') followed by a new line ('\n') | | space2mysqlblank.py | Replaces space character (' ') with a random blank character from a valid set of alternate characters | | space2mysqldash.py | Replaces space character (' ') with a dash comment ('--') followed by a new line ('\n') | | space2plus.py | Replaces space character (' ') with plus ('+') | | space2randomblank.py | Replaces space character (' ') with a random blank character from a valid set of alternate characters | | symboliclogical.py | Replaces AND and OR logical operators with their symbolic counterparts (&& and \|\|) | | unionalltounion.py | Replaces UNION ALL SELECT with UNION SELECT | | unmagicquotes.py | Replaces quote character (') with a multi-byte combo %bf%27 together with generic comment at the end (to make it work) | | uppercase.py | Replaces each keyword character with upper case value 'INSERT' | | varnish.py | Append a HTTP header 'X-originating-IP' | | versionedkeywords.py | Encloses each non-function keyword with versioned MySQL comment | | versionedmorekeywords.py | Encloses each keyword with versioned MySQL comment | | xforwardedfor.py | Append a fake HTTP header 'X-Forwarded-For' |

Source: SQL Injection/SQLmap.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 157 to 182, reading order first.

  1. SQLite Injection: SQLite Comments§ 157text · SQLite Injection.md
  2. SQLite Injection: SQLite Enumeration§ 158text · SQLite Injection.md
  3. SQLite Injection: SQLite String Methodology§ 159text · SQLite Injection.md
  4. SQLite Injection: SQLite Blind Methodology§ 160text · SQLite Injection.md
  5. SQLite Injection: SQLite Blind With Substring Equivalent§ 161text · SQLite Injection.md
  6. SQLite Injection: SQlite Error Based§ 1621 code block · SQLite Injection.md
  7. SQLite Injection: SQlite Time Based§ 1631 code block · SQLite Injection.md
  8. SQLite Injection: Attach Database§ 1643 code blocks · SQLite Injection.md
  9. SQLite Injection: Loadextension§ 1653 code blocks · SQLite Injection.md
  10. SQLite Injection: SQLite Read File§ 166text · SQLite Injection.md
  11. SQLite Injection: SQLite Write File§ 1671 code block · SQLite Injection.md
  12. SQLmap: SQLmap§ 168text · SQLmap.md
  13. SQLmap: Basic Arguments For SQLmap§ 1691 code block · SQLmap.md
  14. SQLmap: Load A Request File§ 1701 code block · SQLmap.md
  15. SQLmap: Custom Injection Point§ 1711 code block · SQLmap.md
  16. SQLmap: Second Order Injection§ 1721 code block · SQLmap.md
  17. SQLmap: Getting A Shell§ 173text · SQLmap.md
  18. SQLmap: Crawl And Auto-Exploit§ 1741 code block · SQLmap.md
  19. SQLmap: Proxy Configuration For SQLmap§ 1751 code block · SQLmap.md
  20. SQLmap: Injection Tampering§ 176text · SQLmap.md
  21. SQLmap: Suffix And Prefix§ 1771 code block · SQLmap.md
  22. SQLmap: Default Tamper Scripts§ 1781 code block · SQLmap.md
  23. SQLmap: Custom Tamper Scripts§ 1791 code block · SQLmap.md
  24. SQLmap: Custom SQL Payload§ 1801 code block · SQLmap.md
  25. SQLmap: Evaluate Python Code§ 1811 code block · SQLmap.md
  26. SQLmap: Preprocess And Postprocess Scripts§ 1821 code block · SQLmap.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in