Skip to content

Commit 2895e5c

Browse files
stamparmstamparm
committed
Initial commit for #3140 
1 parent b1e8c75 commit 2895e5c

4 files changed

Lines changed: 214 additions & 23 deletions

File tree

‎lib/core/settings.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from lib.core.enums import OS
2020

2121
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
22-
VERSION = "1.2.11.7"
22+
VERSION = "1.2.11.8"
2323
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2424
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2525
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)

‎lib/utils/api.py‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858

5959
# Global data storage
6060
class DataStore(object):
61-
admin_id = ""
61+
admin_token = ""
6262
current_db = None
6363
tasks = dict()
6464
username = None
@@ -275,8 +275,8 @@ def setRestAPILog():
275275
logger.addHandler(LOGGER_RECORDER)
276276

277277
# Generic functions
278-
def is_admin(taskid):
279-
return DataStore.admin_id == taskid
278+
def is_admin(token):
279+
return DataStore.admin_token == token
280280

281281
@hook('before_request')
282282
def check_authentication():
@@ -358,7 +358,7 @@ def path_401():
358358
@get("/task/new")
359359
def task_new():
360360
"""
361-
Create new task ID
361+
Create a new task
362362
"""
363363
taskid = hexencode(os.urandom(8))
364364
remote_addr = request.remote_addr
@@ -371,47 +371,50 @@ def task_new():
371371
@get("/task/<taskid>/delete")
372372
def task_delete(taskid):
373373
"""
374-
Delete own task ID
374+
Delete an existing task
375375
"""
376376
if taskid in DataStore.tasks:
377377
DataStore.tasks.pop(taskid)
378378

379379
logger.debug("[%s] Deleted task" % taskid)
380380
return jsonize({"success": True})
381381
else:
382-
logger.warning("[%s] Invalid task ID provided to task_delete()" % taskid)
383-
return jsonize({"success": False, "message": "Invalid task ID"})
382+
response.status = 404
383+
logger.warning("[%s] Non-existing task ID provided to task_delete()" % taskid)
384+
return jsonize({"success": False, "message": "Non-existing task ID"})
384385

385386
###################
386387
# Admin functions #
387388
###################
388389

389-
@get("/admin/<taskid>/list")
390-
def task_list(taskid=None):
390+
@get("/admin/list")
391+
@get("/admin/<token>/list")
392+
def task_list(token=None):
391393
"""
392-
List task pull
394+
Pull task list
393395
"""
394396
tasks = {}
395397

396398
for key in DataStore.tasks:
397-
if is_admin(taskid) or DataStore.tasks[key].remote_addr == request.remote_addr:
399+
if is_admin(token) or DataStore.tasks[key].remote_addr == request.remote_addr:
398400
tasks[key] = dejsonize(scan_status(key))["status"]
399401

400-
logger.debug("[%s] Listed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr))
402+
logger.debug("[%s] Listed task pool (%s)" % (token, "admin" if is_admin(token) else request.remote_addr))
401403
return jsonize({"success": True, "tasks": tasks, "tasks_num": len(tasks)})
402404

403-
@get("/admin/<taskid>/flush")
404-
def task_flush(taskid):
405+
@get("/admin/flush")
406+
@get("/admin/<token>/flush")
407+
def task_flush(token=None):
405408
"""
406409
Flush task spool (delete all tasks)
407410
"""
408411

409412
for key in list(DataStore.tasks):
410-
if is_admin(taskid) or DataStore.tasks[key].remote_addr == request.remote_addr:
413+
if is_admin(token) or DataStore.tasks[key].remote_addr == request.remote_addr:
411414
DataStore.tasks[key].engine_kill()
412415
del DataStore.tasks[key]
413416

414-
logger.debug("[%s] Flushed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr))
417+
logger.debug("[%s] Flushed task pool (%s)" % (token, "admin" if is_admin(token) else request.remote_addr))
415418
return jsonize({"success": True})
416419

417420
##################################
@@ -647,7 +650,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
647650
REST-JSON API server
648651
"""
649652

650-
DataStore.admin_id = hexencode(os.urandom(16))
653+
DataStore.admin_token = hexencode(os.urandom(16))
651654
DataStore.username = username
652655
DataStore.password = password
653656

@@ -660,7 +663,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
660663
port = s.getsockname()[1]
661664

662665
logger.info("Running REST-JSON API server at '%s:%d'.." % (host, port))
663-
logger.info("Admin ID: %s" % DataStore.admin_id)
666+
logger.info("Admin (secret) token: %s" % DataStore.admin_token)
664667
logger.debug("IPC database: '%s'" % Database.filepath)
665668

666669
# Initialize IPC database
@@ -696,7 +699,7 @@ def server(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, adapter=REST
696699
logger.critical(errMsg)
697700

698701
def _client(url, options=None):
699-
logger.debug("Calling %s" % url)
702+
logger.debug("Calling '%s'" % url)
700703
try:
701704
data = None
702705
if options is not None:
@@ -833,7 +836,7 @@ def client(host=RESTAPI_DEFAULT_ADDRESS, port=RESTAPI_DEFAULT_PORT, username=Non
833836
logger.info("Switching to task ID '%s' " % taskid)
834837

835838
elif command in ("list", "flush"):
836-
raw = _client("%s/admin/%s/%s" % (addr, taskid or 0, command))
839+
raw = _client("%s/admin/%s" % (addr, command))
837840
res = dejsonize(raw)
838841
if not res["success"]:
839842
logger.error("Failed to execute command %s" % command)

‎swagger.yaml‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
swagger: "2.0"
2+
info:
3+
description: ""
4+
version: "1.2"
5+
title: "sqlmap API (REST-JSON)"
6+
contact:
7+
email: "dev@sqlmap.org"
8+
license:
9+
name: "GPL 2.0"
10+
url: "https://www.gnu.org/licenses/old-licenses/gpl-2.0.html"
11+
host: "0.0.0.0:8775"
12+
basePath: "/"
13+
tags:
14+
- name: "task"
15+
description: "Task management functions"
16+
- name: "admin"
17+
description: "Task administration functions"
18+
- name: "option"
19+
description: "Task option handling functions"
20+
schemes:
21+
- "http"
22+
paths:
23+
/task/new:
24+
get:
25+
tags:
26+
- "task"
27+
summary: "Create a new task"
28+
description: ""
29+
operationId: "taskNew"
30+
produces:
31+
- "application/json"
32+
parameters: []
33+
responses:
34+
200:
35+
description: "Task successfully created"
36+
schema:
37+
type: object
38+
properties:
39+
success:
40+
type: boolean
41+
taskid:
42+
type: string
43+
example: "7e605b5d5a892b74"
44+
/task/{taskid}/delete:
45+
get:
46+
tags:
47+
- "task"
48+
summary: "Delete an existing task"
49+
description: ""
50+
operationId: "taskDelete"
51+
produces:
52+
- "application/json"
53+
parameters:
54+
- name: "taskid"
55+
in: "path"
56+
description: "ID of an existing task to delete"
57+
required: true
58+
type: "string"
59+
responses:
60+
200:
61+
description: "Task successfully deleted"
62+
schema:
63+
type: object
64+
properties:
65+
success:
66+
type: boolean
67+
enum: [true]
68+
404:
69+
description: "Task ID not found"
70+
schema:
71+
type: object
72+
properties:
73+
success:
74+
type: boolean
75+
enum: [false]
76+
message:
77+
type: string
78+
enum: ["Non-existing task ID"]
79+
/admin/list:
80+
get:
81+
tags:
82+
- "admin"
83+
summary: "Pull task list (locally)"
84+
description: "Note: Use in cases when connecting to server from same IP (e.g. `localhost`)"
85+
operationId: "adminList"
86+
produces:
87+
- "application/json"
88+
responses:
89+
200:
90+
description: "Task list successfully pulled"
91+
schema:
92+
type: object
93+
properties:
94+
success:
95+
type: boolean
96+
enum: [true]
97+
tasks:
98+
type: object
99+
additionalProperties:
100+
type: string
101+
example:
102+
16a7a898e8eaaf45: running
103+
644fc063408e4f12: not running
104+
8e2eb10770d913cd: not running
105+
d59d1c69bdc06933: not running
106+
tasks_num:
107+
type: integer
108+
example: 4
109+
/admin/{token}/list:
110+
get:
111+
tags:
112+
- "admin"
113+
summary: "Pull task list (remotely)"
114+
description: "Note: Use in cases when connecting to server from different IP"
115+
operationId: "adminListToken"
116+
produces:
117+
- "application/json"
118+
parameters:
119+
- name: "token"
120+
in: "path"
121+
description: "Secret token (Note: written to console during a server run - e.g. `2756d5b6e7d093ba49b5fd06a93aca7a`)"
122+
required: true
123+
type: "string"
124+
responses:
125+
200:
126+
description: "Task list successfully pulled"
127+
schema:
128+
type: object
129+
properties:
130+
success:
131+
type: boolean
132+
enum: [true]
133+
tasks:
134+
type: object
135+
additionalProperties:
136+
type: string
137+
example:
138+
5c911efa476b55f4: not running
139+
5ee038e153ffc534: not running
140+
e58c7a4de6bf7f51: not running
141+
tasks_num:
142+
type: integer
143+
example: 4
144+
/admin/flush:
145+
get:
146+
tags:
147+
- "admin"
148+
summary: "Flush task pool (locally)"
149+
description: "Note: Use in cases when connecting to server from same IP (e.g. `localhost`)"
150+
operationId: "adminFlush"
151+
produces:
152+
- "application/json"
153+
responses:
154+
200:
155+
description: "Task pool successfully flushed"
156+
schema:
157+
type: object
158+
properties:
159+
success:
160+
type: boolean
161+
enum: [true]
162+
/admin/{token}/flush:
163+
get:
164+
tags:
165+
- "admin"
166+
summary: "Flush task pool (remotely)"
167+
description: "Note: Use in cases when connecting to server from different IP"
168+
operationId: "adminFlushToken"
169+
produces:
170+
- "application/json"
171+
parameters:
172+
- name: "token"
173+
in: "path"
174+
description: "Secret token (Note: written to console during a server run - e.g. `2756d5b6e7d093ba49b5fd06a93aca7a`)"
175+
required: true
176+
type: "string"
177+
responses:
178+
200:
179+
description: "Task pool successfully flushed"
180+
schema:
181+
type: object
182+
properties:
183+
success:
184+
type: boolean
185+
enum: [true]
186+
externalDocs:
187+
description: "Find out more about sqlmap API (REST-JSON)"
188+
url: "https://github.com/sqlmapproject/sqlmap/wiki/Usage#api-rest-json"

‎txt/checksum.md5‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ c8c386d644d57c659d74542f5f57f632 lib/core/patch.py
4949
0c3eef46bdbf87e29a3f95f90240d192 lib/core/replication.py
5050
a7db43859b61569b601b97f187dd31c5 lib/core/revision.py
5151
fcb74fcc9577523524659ec49e2e964b lib/core/session.py
52-
2ec7d2bc8a0e0c387488c41c0cd44f51 lib/core/settings.py
52+
f6c316b9de14838f5a70072e514c5974 lib/core/settings.py
5353
a971ce157d04de96ba6e710d3d38a9a8 lib/core/shell.py
5454
a7edc9250d13af36ac0108f259859c19 lib/core/subprocessng.py
5555
721198b5be72c8015a02acb116532a1f lib/core/target.py
@@ -101,7 +101,7 @@ db208ab47de010836c6bf044e2357861 lib/techniques/blind/inference.py
101101
1e5532ede194ac9c083891c2f02bca93 lib/techniques/union/__init__.py
102102
f7813cdee00df8f98d6f811475e520a1 lib/techniques/union/test.py
103103
7361338240ecd9d01d1d10ec76bce069 lib/techniques/union/use.py
104-
77ff35587af9e3dfde63b8327e230f9a lib/utils/api.py
104+
dfea8e2ca23c5160b2f57732d8d49023 lib/utils/api.py
105105
37dfb641358669f62c2acedff241348b lib/utils/brute.py
106106
31b1e7eb489eac837db6a2bc1dcb7da7 lib/utils/crawler.py
107107
f9867bbfcd6d31916ca73e72e95fd881 lib/utils/deps.py

0 commit comments

Comments
 (0)