Minor update for Oracle support

tamper/dollarquote.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
+See the file 'LICENSE' for copying permission
+"""
+
+import os
+import re
+
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.LOW
+
+def dependencies():
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.PGSQL))
+
+def tamper(payload, **kwargs):
+    """
+    Replaces single-quoted strings with PostgreSQL dollar-quoted strings (e.g. 'abc' -> $$abc$$)
+
+    Requirement:
+        * PostgreSQL
+
+    Tested against:
+        * PostgreSQL 9.x, 10-16
+
+    Notes:
+        * Useful to bypass filters that block, strip or escape the single-quote
+          character: dollar-quoting is quote-free and needs no escaping
+        * A literal already containing '$$' is left untouched
+
+    >>> tamper("SELECT 'abc' FROM t WHERE x='def'")
+    'SELECT $$abc$$ FROM t WHERE x=$$def$$'
+    """
+
+    retVal = payload
+
+    if payload:
+        retVal = re.sub(r"'([^']*)'", lambda match: "$$%s$$" % match.group(1) if "$$" not in match.group(1) else match.group(0), payload)
+
+    return retVal

tamper/oraclequote.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python
+
+"""
+Copyright (c) 2006-2026 sqlmap developers (https://sqlmap.org)
+See the file 'LICENSE' for copying permission
+"""
+
+import os
+import re
+
+from lib.core.common import singleTimeWarnMessage
+from lib.core.enums import DBMS
+from lib.core.enums import PRIORITY
+
+__priority__ = PRIORITY.LOW
+
+def dependencies():
+    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s" % (os.path.basename(__file__).split(".")[0], DBMS.ORACLE))
+
+def tamper(payload, **kwargs):
+    """
+    Replaces single-quoted strings with Oracle alternative-quoted strings (e.g. 'abc' -> q'[abc]')
+
+    Requirement:
+        * Oracle 10g+
+
+    Tested against:
+        * Oracle 11g, 12c, 18c, 19c, 21c, 23ai
+
+    Notes:
+        * Useful to bypass filters that block, strip or escape the single-quote
+          character: q-quoting delimits the literal with a chosen bracket/char
+          so the inner text needs no quote at all
+        * The first delimiter whose characters are absent from the literal is
+          used; a literal that contains every candidate delimiter is left untouched
+
+    >>> tamper("SELECT 'abc' FROM DUAL")
+    "SELECT q'[abc]' FROM DUAL"
+    """
+
+    def _quote(match):
+        value = match.group(1)
+        for start, end in (("[", "]"), ("{", "}"), ("(", ")"), ("<", ">"), ("!", "!"), ("|", "|"), ("#", "#")):
+            if start not in value and end not in value:
+                return "q'%s%s%s'" % (start, value, end)
+        return match.group(0)
+
+    retVal = payload
+
+    if payload:
+        retVal = re.sub(r"'([^']*)'", _quote, payload)
+
+    return retVal