sqlmapapi&Tamper&Pocsuite

Yatming的博客2025-05-202023-09-05

076b564f9ed69982c9ab2855fd1db7b2

sqlmapAPI调用实现自动化SQL注入安全检测

https://www.freebuf.com/articles/web/204875.html

应用案例：前期通过信息收集拿到大量的URL地址，然后配合sqlmapAPI接口进行批量的sql注入检测（SRC挖掘）

创建新任务记录任务ID @get(“/task/new”)
设置任务ID扫描信息@get(“/option//set”)
开始扫描对应ID任务 @get(“/scan//start”)
读取扫描状态判断结果 @get(“/scan//status”)
如果结束删除ID@get(“/task//delete”)
扫描结果查看@get(“/scan//data”)

首先：进入sqlmap目录，启动sqlmapapi，命令：python sqlmapapi.py -s

Snipaste_2023-09-04_12-42-54

Snipaste_2023-09-04_12-43-35

代码1：

import requests,json

# 创建新任务，记录任务ID
task_new_url = 'http://127.0.0.1:8775/task/new'
resp = requests.get(task_new_url)
task_id = resp.json()['taskid']
print(task_id)

# 设置任务ID的配置信息（扫描信息）
data = {
    "url": "http://127.0.0.1/sqli-labs-master/Less-2/?id=1"
}
headers = {
    "Content-Type": "application/json"
}
task_set_url = "http://127.0.0.1:8775/option/" + str(task_id) + "/set"
task_set_resp = requests.post(task_set_url, data=json.dumps(data), headers=headers)
print(task_set_resp.json())

# 启动对应ID的扫描任务
task_start_url = "http://127.0.0.1:8775/scan/" + str(task_id) + "/start"
task_start_resp = requests.post(task_start_url, data=json.dumps(data), headers=headers)
print(task_start_resp.json())


# 获取对应ID的扫描状态
task_status_url = "http://127.0.0.1:8775/scan/" + str(task_id) + "/status"
task_status_resp = requests.get(task_status_url)
print(task_status_resp.json())

访问

1
2
3

http://127.0.0.1:8775/scan/43299c324c1539a8/data

这里的43299c324c1539a8是task_id

Snipaste_2023-09-04_13-02-05

由于每一次都是新创建一个任务，需要进行优化，使得只创建一个任务进行扫描，这里通过if语句进行判断，如果上一步成功才进行下一步

sqlmapapi plus

import time
import requests, json


# 首先：进入sqlmap目录，启动sqlmapapi，命令：python sqlmapapi.py -s


def sqlmapapi(url):
    data = {
        "url": url
    }
    headers = {
        "Content-Type": "application/json"
    }

    # 创建新任务，记录任务ID
    task_new_url = 'http://127.0.0.1:8775/task/new'
    resp = requests.get(task_new_url)
    task_id = resp.json()['taskid']
    # print(task_id)

    if 'success' in resp.content.decode('utf-8'):
        print('sqlmapapi task create success!')
        # 设置任务ID的配置信息（扫描信息）
        task_set_url = "http://127.0.0.1:8775/option/" + task_id + "/set"
        task_set_resp = requests.post(task_set_url, data=json.dumps(data), headers=headers)
        # print(task_set_resp.json())

        if 'success' in task_set_resp.content.decode('utf-8'):
            print('sqlmapapi task set success!')
            # 启动对应ID的扫描任务
            task_start_url = "http://127.0.0.1:8775/scan/" + task_id + "/start"
            task_start_resp = requests.post(task_start_url, data=json.dumps(data), headers=headers)
            # print(task_start_resp.json())
            if 'success' in task_start_resp.content.decode('utf-8'):
                print('sqlmapapi task start success!')
                while 1:
                    # 获取对应ID的扫描状态
                    task_status_url = "http://127.0.0.1:8775/scan/" + task_id + "/status"
                    task_status_resp = requests.get(task_status_url)
                    # print(task_status_resp.json())
                    if 'running' in task_status_resp.content.decode('utf-8'):
                        print('suqmapapi task scan running!-->' + url)
                        pass
                    else:
                        # print('sqlmapapi task scan end!')
                        # 扫描结果查看
                        task_data_url = "http://127.0.0.1:8775/scan/" + task_id + "/data"
                        task_data_resp = requests.get(task_data_url).content.decode('utf-8')
                        print(task_data_resp)
                        with open(r'scan_result.txt', 'a+') as f:
                            f.write(url + '\n')
                            f.write(task_data_resp + '\n')
                            f.write('==========python sqlmapapi by yatming==========' + '\n')
                        # 如果结束删除ID
                        task_delete_url = "http://127.0.0.1:8775/task/" + task_id + "/delete"
                        task_delete_resp = requests.get(task_delete_url)
                        if 'success' in task_delete_resp.content.decode('utf-8'):
                            print('delete taskid success!')
                        break
                    time.sleep(3)


if __name__ == '__main__':
    for url in open('url.txt'):
        url = url.replace('\n', '')
        # print(url)
        sqlmapapi(url)