Research Overview

Formal talk abstracts, blogs, and social content for the SQL Tamper Framework.

Talks

Tampering Is Parsing: Building a Context-Aware SQLMap Bypass Framework

SQLMap tamper scripts are usually fragile string manipulators, and they fail in the same three ways: they corrupt multi-character operators, they desynchronize position-based token tracking the moment a transformation changes a token’s length, and they cannot tell which SQL clause a token belongs to. Each failure produces invalid SQL, which the database rejects. This talk presents the SQL Tamper Framework, a rewrite that treats tampering as a lex-transform-reassemble pipeline. We cover the lexer that recognizes multi-character operators as single tokens and assigns each token a stable UUID, the context tracker that maintains clause state so transformations fire only where they are valid, and the deterministic, reapplication-safe transformer built on top. We then walk the modular transformation library (from version comments to homoglyphs and hex encoding) and the seven WAF-specific tamper scripts and env-driven combiner that ship on top of it, and close with the project’s tests, its published benchmarks, and its deliberately deterministic, authorized-use-only design posture. Aimed at penetration testers, bug bounty hunters, and tool builders.

Publications & Articles

Why most SQLMap tamper scripts produce broken SQL, and how I fixed it

A WAF bypass tamper script has one job: change how a SQL payload looks so it dodges the firewall’s signatures, without changing what the database runs. Most tamper scripts fail that second part, because they treat SQL as a string. It isn’t.

Three bugs kept biting me. Encode >= character by character and you get %3E=, which isn’t a valid operator. Track a token by position and the moment you wrap SELECT into /*!50000SELECT*/, every position after it shifts and your tracking desyncs. Encode every = and you corrupt the SELECT list; encode none and you don’t bypass the WHERE clause. All three produce invalid SQL, which the database rejects, which is the whole ballgame lost.

So I rewrote the SQL Tamper Framework around a real lexer. It recognizes multi-character operators as single tokens (so >= encodes atomically to %3E%3D), gives every token a UUID that survives value changes (so tracking never desyncs), and tracks which SQL clause each token is in (so operators get encoded in WHERE but not SELECT). Output is deterministic on purpose: reproducible for research and verification, and no random-variant engine to abuse.

On top of that engine sit modular transformations (version comments, homoglyphs, hex encoding, function wrapping, and more) and seven ready-to-run SQLMap tamper scripts tuned to specific WAFs: Cloudflare, AWS, Azure, ModSecurity, Imperva, Akamai, plus an env-driven combiner. It targets MySQL/MariaDB, it’s GPL v2, and it’s on PyPI as sqlmap-tamper-framework. Authorized testing only.

Language Overview Blurb

The SQL Tamper Framework is a context-aware SQL transformation framework for WAF bypass, built for authorized penetration testing and bug bounty use. It lexes SQL into UUID-tracked tokens, tracks clause context, and applies deterministic, reapplication-safe transformations that keep payloads valid SQL, fixing the multi-character-operator, position-tracking, and context-blindness bugs of naive tamper scripts. It ships a modular transformation library, seven SQLMap tamper scripts for major WAFs (Cloudflare, AWS, Azure, ModSecurity, Imperva, Akamai) and an environment-driven combiner. MySQL/MariaDB focused, GPL v2, on PyPI as sqlmap-tamper-framework.