最近想研究一下sqlmapapi.py这个东西， 先找到一篇这个。
from: http://volatile-minds.blogspot.jp/2013/04/unofficial-sqlmap-restful-api.html
This isn‘t comprehensive, just the most useful methods. I haven‘t found any docs on
the API yet but wanted to play with it. :)
本文不是全面的，只是最有用的方法。我还没找到任何关于API的文档，但我想尝试一把。
The full list of methods available are:
可用的methods列出如下
@get("/task/new")
@get("/task/<taskid>/delete")
@get("/admin/<taskid>/list")
@get("/admin/<taskid>/flush")
@get("/option/<taskid>/list")
@post("/option/<taskid>/get")
@post("/option/<taskid>/set")
@post("/scan/<taskid>/start")
@get("/scan/<taskid>/stop")
@get("/scan/<taskid>/kill")
@get("/scan/<taskid>/status")
@get("/scan/<taskid>/data")
@get("/scan/<taskid>/log/<start>/<end>")
@get("/scan/<taskid>/log")
@get("/download/<taskid>/<target>/<filename:path>")
These are the methods I have been using
我常用的
GET /task/new
Response:
{
"taskid": "1d47d7f046df1504"
}
GET /task/<task_id>/delete
Response:
{
"success": true
}
GET /option/<task_id>/list Response:
{
"options": {
"crawlDepth": null,
"osShell": false,
"getUsers": false,
"getPasswordHashes": false,
"excludeSysDbs": false,
"uChar": null,
"regData": null,
"cpuThrottle": 5,
"prefix": null,
"code": null,
"googlePage": 1,
"query": null,
"randomAgent": false,
"delay": 0,
"isDba": false,
"requestFile": null,
"predictOutput": false,
"wizard": false,
"stopFail": false,
"forms": false,
"taskid": "73674cc5eace4ac7",
"skip": null,
"dropSetCookie": false,
"smart": false,
"risk": 1,
"sqlFile": null,
"rParam": null,
"getCurrentUser": false,
"notString": null,
"getRoles": false,
"getPrivileges": false,
"testParameter": null,
"tbl": null,
"charset": null,
"trafficFile": null,
"osSmb": false,
"level": 1,
"secondOrder": null,
"pCred": null,
"timeout": 30,
"firstChar": null,
"updateAll": false,
"binaryFields": false,
"checkTor": false,
"aType": null,
"direct": null,
"saFreq": 0,
"tmpPath": null,
"titles": false,
"getSchema": false,
"identifyWaf": false,
"checkWaf": false,
"regKey": null,
"limitStart": null,
"loadCookies": null,
"dnsName": null,
"csvDel": ",",
"oDir": null,
"osBof": false,
"invalidLogical": false,
"getCurrentDb": false,
"hexConvert": false,
"answers": null,
"host": null,
"dependencies": false,
"cookie": null,
"proxy": null,
"regType": null,
"optimize": false,
"limitStop": null,
"mnemonics": null,
"uFrom": null,
"noCast": false,
"testFilter": null,
"eta": false,
"threads": 1,
"logFile": null,
"os": null,
"col": null,
"rFile": null,
"verbose": 1,
"aCert": null,
"torPort": null,
"privEsc": false,
"forceDns": false,
"getAll": false,
"api": true,
"url": null,
"invalidBignum": false,
"regexp": null,
"getDbs": false,
"freshQueries": false,
"uCols": null,
"smokeTest": false,
"pDel": null,
"wFile": null,
"udfInject": false,
"tor": false,
"forceSSL": false,
"beep": false,
"saveCmdline": false,
"configFile": null,
"scope": null,
"dumpAll": false,
"torType": "HTTP",
"regVal": null,
"dummy": false,
"commonTables": false,
"search": false,
"skipUrlEncode": false,
"referer": null,
"liveTest": false,
"purgeOutput": false,
"retries": 3,
"extensiveFp": false,
"dumpTable": false,
"database": "/tmp/sqlmapipc-EmjjlQ",
"batch": true,
"headers": null,
"flushSession": false,
"osCmd": null,
"suffix": null,
"dbmsCred": null,
"regDel": false,
"shLib": null,
"nullConnection": false,
"timeSec": 5,
"msfPath": null,
"noEscape": false,
"getHostname": false,
"sessionFile": null,
"disableColoring": true,
"getTables": false,
"agent": null,
"lastChar": null,
"string": null,
"dbms": null,
"tamper": null,
"hpp": false,
"runCase": null,
"osPwn": false,
"evalCode": null,
"cleanup": false,
"getBanner": false,
"profile": false,
"regRead": false,
"bulkFile": null,
"safUrl": null,
"db": null,
"dumpFormat": "CSV",
"alert": null,
"user": null,
"parseErrors": false,
"aCred": null,
"getCount": false,
"dFile": null,
"data": null,
"regAdd": false,
"ignoreProxy": false,
"getColumns": false,
"mobile": false,
"googleDork": null,
"sqlShell": false,
"pageRank": false,
"tech": "BEUSTQ",
"textOnly": false,
"commonColumns": false,
"keepAlive": false
}
}
POST /option/<task_id>/set -- Content-Type:application/json
Request:
{ "msfPath" : "/path/to/metasploit/framework" }
Response:
{
"success": true
}
POST /scan/<task_id>/start -- Content-Type:application/json
Request (optional):
{ "url" : "192.168.1.250/index.php?wut=injectable" }
Response:
{
"engineid": 16784,
"success": true
}
GET /scan/<task_id>/log
Response:
{
"log": [
{
"message": "testing connection to the target URL",
"level": "INFO",
"time": "14:11:23"
},
{
"message": "testing if the target URL is stable. This can take a couple of seconds",
"level": "INFO",
"time": "14:11:24"
},
{
"message": "target URL is stable",
"level": "INFO",
"time": "14:11:26"
},
{
"message": "no parameter(s) found for testing in the provided data (e.g. GET parameter ‘id‘ in ‘www.site.com/index.php?id=1‘)",
"level": "CRITICAL",
"time": "14:11:26"
},
{
"message": "testing connection to the target URL",
"level": "INFO",
"time": "14:17:30"
},
{
"message": "testing if the target URL is stable. This can take a couple of seconds",
"level": "INFO",
"time": "14:17:31"
},
{
"message": "target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user‘s manual paragraph ‘Page comparison‘ and provide a string or regular expression to match on",
"level": "WARNING",
"time": "14:17:33"
},
{
"message": "testing if GET parameter ‘PAGE‘ is dynamic",
"level": "INFO",
"time": "14:17:33"
},
{
"message": "confirming that GET parameter ‘PAGE‘ is dynamic",
"level": "INFO",
"time": "14:17:33"
},
{
"message": "GET parameter ‘PAGE‘ does not appear dynamic",
"level": "WARNING",
"time": "14:17:33"
},
{
"message": "reflective value(s) found and filtering out",
"level": "WARNING",
"time": "14:17:33"
},
{
"message": "heuristic (basic) test shows that GET parameter ‘PAGE‘ might not be injectable",
"level": "WARNING",
"time": "14:17:33"
},
{
"message": "testing for SQL injection on GET parameter ‘PAGE‘",
"level": "INFO",
"time": "14:17:34"
},
{
"message": "testing ‘AND boolean-based blind - WHERE or HAVING clause‘",
"level": "INFO",
"time": "14:17:34"
},
{
"message": "testing ‘MySQL >= 5.0 AND error-based - WHERE or HAVING clause‘",
"level": "INFO",
"time": "14:17:34"
},
{
"message": "testing ‘PostgreSQL AND error-based - WHERE or HAVING clause‘",
"level": "INFO",
"time": "14:17:34"
},
{
"message": "testing ‘Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause‘",
"level": "INFO",
"time": "14:17:34"
},
{
"message": "testing ‘Oracle AND error-based - WHERE or HAVING clause (XMLType)‘",
"level": "INFO",
"time": "14:17:35"
},
{
"message": "testing ‘MySQL inline queries‘",
"level": "INFO",
"time": "14:17:35"
},
{
"message": "testing ‘PostgreSQL inline queries‘",
"level": "INFO",
"time": "14:17:35"
},
{
"message": "testing ‘Microsoft SQL Server/Sybase inline queries‘",
"level": "INFO",
"time": "14:17:35"
},
{
"message": "testing ‘Oracle inline queries‘",
"level": "INFO",
"time": "14:17:35"
},
{
"message": "testing ‘SQLite inline queries‘",
"level": "INFO",
"time": "14:17:35"
},
{
"message": "testing ‘MySQL > 5.0.11 stacked queries‘",
"level": "INFO",
"time": "14:17:36"
},
{
"message": "testing ‘PostgreSQL > 8.1 stacked queries‘",
"level": "INFO",
"time": "14:17:36"
},
{
"message": "testing ‘Microsoft SQL Server/Sybase stacked queries‘",
"level": "INFO",
"time": "14:17:36"
},
{
"message": "testing ‘MySQL > 5.0.11 AND time-based blind‘",
"level": "INFO",
"time": "14:17:36"
},
{
"message": "testing ‘PostgreSQL > 8.1 AND time-based blind‘",
"level": "INFO",
"time": "14:17:37"
},
{
"message": "testing ‘Microsoft SQL Server/Sybase time-based blind‘",
"level": "INFO",
"time": "14:17:37"
},
{
"message": "testing ‘Oracle AND time-based blind‘",
"level": "INFO",
"time": "14:17:37"
},
{
"message": "testing ‘MySQL UNION query (NULL) - 1 to 10 columns‘",
"level": "INFO",
"time": "14:17:37"
},
{
"message": "testing ‘Generic UNION query (NULL) - 1 to 10 columns‘",
"level": "INFO",
"time": "14:17:38"
},
{
"message": "using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option ‘--dbms‘",
"level": "WARNING",
"time": "14:17:38"
},
{
"message": "GET parameter ‘PAGE‘ is not injectable",
"level": "WARNING",
"time": "14:17:39"
},
{
"message": "all tested parameters appear to be not injectable. Try to increase ‘--level‘/‘--risk‘ values to perform more tests. Also, you can try to rerun by providing either a valid value for option ‘--string‘ (or ‘--regexp‘)",
"level": "CRITICAL",
"time": "14:17:40"
},
{
"message": "HTTP error codes detected during run:\n404 (Not Found) - 183 times",
"level": "WARNING",
"time": "14:17:40"
}
]
}
GET /scan/<task_id>/status
Response:
{
"status": "terminated",
"returncode": 0
}
时间： 2024-08-05 11:16:24