{"action":"closed","issue":{"url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1701","repository_url":"https://api.github.com/repos/sqlmapproject/sqlmap","labels_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1701/labels{/name}","comments_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1701/comments","events_url":"https://api.github.com/repos/sqlmapproject/sqlmap/issues/1701/events","html_url":"https://github.com/sqlmapproject/sqlmap/issues/1701","id":132406352,"number":1701,"title":"Sqlmap filter bypass","user":{"login":"grayte","id":17141464,"avatar_url":"https://avatars.githubusercontent.com/u/17141464?v=3","gravatar_id":"","url":"https://api.github.com/users/grayte","html_url":"https://github.com/grayte","followers_url":"https://api.github.com/users/grayte/followers","following_url":"https://api.github.com/users/grayte/following{/other_user}","gists_url":"https://api.github.com/users/grayte/gists{/gist_id}","starred_url":"https://api.github.com/users/grayte/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/grayte/subscriptions","organizations_url":"https://api.github.com/users/grayte/orgs","repos_url":"https://api.github.com/users/grayte/repos","events_url":"https://api.github.com/users/grayte/events{/privacy}","received_events_url":"https://api.github.com/users/grayte/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-09T12:18:44Z","updated_at":"2016-02-09T12:28:19Z","closed_at":"2016-02-09T12:28:19Z","body":"'m looking at a test site with waf bypass. While it is relatively straightforward to bypass the waf manually, I'm having a hard time getting sqlmap to 1. realise that the site is injectible and 2. bypass the waf.\r\n\r\nIn order to bypass the waf a string needs to be added in front and behind each keyword. These are not only limited to union all select but also to keywords such as @@version, table_name etc.\r\nIn order to bypass the waf, it is required to add \" /*! \" in front of every keyword and \" */ \" behind every keyword. So that a query will look like this:\r\n\r\nand 0 /*!UNiOn*/ all / /*!table_name*/+from /*!information_schema*/./*!tables*/ where table_schema=database()\r\n\r\nI need a tamperscript that would be able to this.\r\n\r\nThanks for your time!"}}