Tamper Scripts (WAF Bypass)
Tamper scripts modify SQLMap payloads to bypass Web Application Firewalls (WAFs), IDS, and input filters. Use --tamper=script1,script2 to apply one or more scripts.
Chaining Multiple Tamper Scripts
You can combine multiple tamper scripts for stronger WAF bypass:
1sqlmap -u 'http://target.com/page?id=1' --tamper=space2comment,randomcase,charencode
All Tamper Scripts
Replaces spaces with SQL comments
Replaces spaces with dash comments --
Replaces spaces with hash comments #
Replaces spaces with multi-line comments
Randomizes case of SQL keywords (SeLeCt)
Replaces > with NOT BETWEEN 0 AND, evades numeric filters
URL-encodes all characters
Base64-encodes the payload
Unicode-encodes characters
Replaces apostrophes with UTF-8 full-width equivalent
Replaces apostrophes with %00%27
Unicodes apostrophes
Replaces = with LIKE operator
Replaces > with GREATEST() function
Replaces < with LEAST() function
Wraps queries in versioned comments for MySQL
ModSecurity zero-versioned technique
Encloses SQL keywords with versioned comments
Encloses more keywords with versioned comments
Adds virgule backslash before quotes
Adds percentage sign before quotes
Half-versioned keywords for MySQL
Tamper for X-Forwarded-For header injection
Tamper for X-Forwarded-Hostname header injection
Tamper for X-Forwarded-Server header injection
Tamper for Referer header injection
Tamper for Referer URL injection