Skip to content

Commit 4a46192

Browse files
needle-wangneedle-wang
committed
API区添加用户名密码entry
1 parent eaedbb9 commit 4a46192

File tree

13 files changed

+109
-24
lines changed

13 files changed

+109
-24
lines changed

‎README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ from sqlmap's FAQ:
3636
- 继续重构, 优化
3737

3838
#### ABOUT
39-
1. V0.3.3
40-
2019-05-14 23:56:35
41-
作者: needle wang ( [email protected] )
42-
2. 使用PyGObject(Gtk+3: python3-gi)重写sqm.py
43-
3. 感谢[sqm](https://github.com/kxcode/gui-for-sqlmap)带来的灵感, 其作者: [KINGX](https://github.com/kxcode) (sqm UI 使用的是python2 + tkinter)
39+
1. V0.3.4
40+
2019-05-17 21:35
41+
作者: needle wang ( [email protected] )
42+
2. 使用PyGObject(Gtk+3: python3-gi)重写sqm.py
43+
3. 感谢[sqm](https://github.com/kxcode/gui-for-sqlmap)带来的灵感, 其作者: [KINGX](https://github.com/kxcode) (sqm UI 使用的是python2 + tkinter)
4444

4545
#### REFERENCE
46-
1. Gtk+3教程: https://python-gtk-3-tutorial.readthedocs.io/en/latest/
47-
2. Gtk+3 API: https://lazka.github.io/pgi-docs/Gtk-3.0/
46+
1. Gtk+3教程: https://python-gtk-3-tutorial.readthedocs.io/en/latest/
47+
2. Gtk+3 API: https://lazka.github.io/pgi-docs/Gtk-3.0/

‎handler_api.py‎

Lines changed: 86 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,15 @@ def task_new(self, button):
2424
@get("/task/new") 创建新任务
2525
'''
2626
_host = self.m._page4_api_server_entry.get_text().strip()
27+
_username = self.m._page4_username_entry.get_text().strip()
28+
_password = self.m._page4_password_entry.get_text().strip()
2729
if _host:
2830
try:
29-
_resp = requests.get('http://%s/task/new' % _host)
31+
_resp = requests.get('http://%s/task/new' % _host,
32+
auth = (_username, _password))
33+
if not _resp:
34+
_resp.raise_for_status()
35+
3036
_resp = _resp.json()
3137
if _resp['success']:
3238
self.task_view_append('%s: 创建成功.' % _resp['taskid'])
@@ -39,9 +45,15 @@ def admin_list(self, button):
3945
'''
4046
_host = self.m._page4_api_server_entry.get_text().strip()
4147
_token = self.m._page4_admin_token_entry.get_text().strip()
48+
_username = self.m._page4_username_entry.get_text().strip()
49+
_password = self.m._page4_password_entry.get_text().strip()
4250
if _host and _token:
4351
try:
44-
_resp = requests.get('http://%s/admin/%s/list' % (_host, _token))
52+
_resp = requests.get('http://%s/admin/%s/list' % (_host, _token),
53+
auth = (_username, _password))
54+
if not _resp:
55+
_resp.raise_for_status()
56+
4557
_resp = _resp.json()
4658
# print(_resp)
4759
if _resp['success']:
@@ -104,9 +116,15 @@ def option_list(self, button, taskid):
104116
@get("/option/<taskid>/list") 获取指定任务的options
105117
'''
106118
_host = self.m._page4_api_server_entry.get_text().strip()
119+
_username = self.m._page4_username_entry.get_text().strip()
120+
_password = self.m._page4_password_entry.get_text().strip()
107121
if _host:
108122
try:
109-
_resp = requests.get('http://%s/option/%s/list' % (_host, taskid))
123+
_resp = requests.get('http://%s/option/%s/list' % (_host, taskid),
124+
auth = (_username, _password))
125+
if not _resp:
126+
_resp.raise_for_status()
127+
110128
_resp = _resp.json()
111129
if _resp['success']:
112130
for _key, _value in _resp['options'].items():
@@ -121,6 +139,8 @@ def option_get(self, button, taskid):
121139
'''
122140
_host = self.m._page4_api_server_entry.get_text()
123141
_buffer_text = self.m._page4_option_get_entry.get_text()
142+
_username = self.m._page4_username_entry.get_text().strip()
143+
_password = self.m._page4_password_entry.get_text().strip()
124144
_options = {}
125145
for _tmp in _buffer_text.split():
126146
_options[_tmp] = None
@@ -130,7 +150,11 @@ def option_get(self, button, taskid):
130150
_headers = {'Content-Type': 'application/json'}
131151
_resp = requests.post('http://%s/option/%s/get' % (_host, taskid),
132152
json = _options,
133-
headers = _headers)
153+
headers = _headers,
154+
auth = (_username, _password))
155+
if not _resp:
156+
_resp.raise_for_status()
157+
134158
_resp = _resp.json()
135159
if _resp['success']:
136160
if _resp['options'].items():
@@ -152,6 +176,8 @@ def option_set(self, button, taskid):
152176
'''
153177
_host = self.m._page4_api_server_entry.get_text()
154178
_buffer_text = self._get_buffer_text(self.m._page4_option_set_view)
179+
_username = self.m._page4_username_entry.get_text().strip()
180+
_password = self.m._page4_password_entry.get_text().strip()
155181
try:
156182
_json = ast.literal_eval(_buffer_text)
157183
except Exception as e:
@@ -162,9 +188,15 @@ def option_set(self, button, taskid):
162188
if _host:
163189
try:
164190
_headers = {'Content-Type': 'application/json'}
191+
# data, json参数都要求是字典类型, 而非字符串
192+
# 另外, 字典的格式比json的宽松(json不能使用单引号, 不能多个逗号)
165193
_resp = requests.post('http://%s/option/%s/set' % (_host, taskid),
166194
json = _json,
167-
headers = _headers)
195+
headers = _headers,
196+
auth = (_username, _password))
197+
if not _resp:
198+
_resp.raise_for_status()
199+
168200
_resp = _resp.json()
169201
if _resp['success']:
170202
_mesg += '设置成功'
@@ -181,9 +213,15 @@ def admin_flush(self, button):
181213
'''
182214
_host = self.m._page4_api_server_entry.get_text()
183215
_token = self.m._page4_admin_token_entry.get_text()
216+
_username = self.m._page4_username_entry.get_text().strip()
217+
_password = self.m._page4_password_entry.get_text().strip()
184218
if _host and _token:
185219
try:
186-
_resp = requests.get('http://%s/admin/%s/flush' % (_host, _token))
220+
_resp = requests.get('http://%s/admin/%s/flush' % (_host, _token),
221+
auth = (_username, _password))
222+
if not _resp:
223+
_resp.raise_for_status()
224+
187225
_resp = _resp.json()
188226
if _resp['success']:
189227
for _a_child in self.w._api_admin_list_rows.get_children():
@@ -197,9 +235,15 @@ def task_delete(self, button, *data):
197235
@get("/task/<taskid>/delete") 删除指定任务
198236
'''
199237
_host = self.m._page4_api_server_entry.get_text().strip()
238+
_username = self.m._page4_username_entry.get_text().strip()
239+
_password = self.m._page4_password_entry.get_text().strip()
200240
if _host:
201241
try:
202-
_resp = requests.get('http://%s/task/%s/delete' % (_host, data[1]))
242+
_resp = requests.get('http://%s/task/%s/delete' % (_host, data[1]),
243+
auth = (_username, _password))
244+
if not _resp:
245+
_resp.raise_for_status()
246+
203247
_resp = _resp.json()
204248
if _resp['success']:
205249
self.w._api_admin_list_rows.remove(data[0])
@@ -213,13 +257,19 @@ def scan_start(self, button, taskid):
213257
要求发送json, 会执行/option/<taskid>/set
214258
'''
215259
_host = self.m._page4_api_server_entry.get_text()
260+
_username = self.m._page4_username_entry.get_text().strip()
261+
_password = self.m._page4_password_entry.get_text().strip()
216262
if _host:
217263
_mesg = '%s: ' % taskid
218264
try:
219265
_headers = {'Content-Type': 'application/json'}
220266
_resp = requests.post('http://%s/scan/%s/start' % (_host, taskid),
221267
json = {},
222-
headers = _headers)
268+
headers = _headers,
269+
auth = (_username, _password))
270+
if not _resp:
271+
_resp.raise_for_status()
272+
223273
_resp = _resp.json()
224274
if _resp['success']:
225275
_mesg = '%sengineid: %s' % (_mesg, _resp['engineid'])
@@ -235,10 +285,16 @@ def scan_stop(self, button, taskid):
235285
@get("/scan/<taskid>/stop") 指定任务 停止扫描
236286
'''
237287
_host = self.m._page4_api_server_entry.get_text()
288+
_username = self.m._page4_username_entry.get_text().strip()
289+
_password = self.m._page4_password_entry.get_text().strip()
238290
if _host:
239291
_mesg = '%s: ' % taskid
240292
try:
241-
_resp = requests.get('http://%s/scan/%s/stop' % (_host, taskid))
293+
_resp = requests.get('http://%s/scan/%s/stop' % (_host, taskid),
294+
auth = (_username, _password))
295+
if not _resp:
296+
_resp.raise_for_status()
297+
242298
_resp = _resp.json()
243299
if _resp['success']:
244300
_mesg += 'ok, stoped.'
@@ -253,10 +309,16 @@ def scan_kill(self, button, taskid):
253309
@get("/scan/<taskid>/kill") kill -9 指定任务
254310
'''
255311
_host = self.m._page4_api_server_entry.get_text()
312+
_username = self.m._page4_username_entry.get_text().strip()
313+
_password = self.m._page4_password_entry.get_text().strip()
256314
if _host:
257315
_mesg = '%s: ' % taskid
258316
try:
259-
_resp = requests.get('http://%s/scan/%s/kill' % (_host, taskid))
317+
_resp = requests.get('http://%s/scan/%s/kill' % (_host, taskid),
318+
auth = (_username, _password))
319+
if not _resp:
320+
_resp.raise_for_status()
321+
260322
_resp = _resp.json()
261323
if _resp['success']:
262324
_mesg += 'ok, killed.'
@@ -272,10 +334,16 @@ def scan_data(self, button, taskid):
272334
data若有内容说明存在注入
273335
'''
274336
_host = self.m._page4_api_server_entry.get_text()
337+
_username = self.m._page4_username_entry.get_text().strip()
338+
_password = self.m._page4_password_entry.get_text().strip()
275339
if _host:
276340
_mesg = '%s:\n' % taskid
277341
try:
278-
_resp = requests.get('http://%s/scan/%s/data' % (_host, taskid))
342+
_resp = requests.get('http://%s/scan/%s/data' % (_host, taskid),
343+
auth = (_username, _password))
344+
if not _resp:
345+
_resp.raise_for_status()
346+
279347
_resp = _resp.json()
280348
# print(_resp) # _resp['data'], _resp['error'] are list
281349
if _resp['success']:
@@ -290,10 +358,16 @@ def scan_log(self, button, taskid):
290358
@get("/scan/<taskid>/log") 查看指定任务的扫描日志
291359
'''
292360
_host = self.m._page4_api_server_entry.get_text()
361+
_username = self.m._page4_username_entry.get_text().strip()
362+
_password = self.m._page4_password_entry.get_text().strip()
293363
if _host:
294364
_mesg = '%s:\n' % taskid
295365
try:
296-
_resp = requests.get('http://%s/scan/%s/log' % (_host, taskid))
366+
_resp = requests.get('http://%s/scan/%s/log' % (_host, taskid),
367+
auth = (_username, _password))
368+
if not _resp:
369+
_resp.raise_for_status()
370+
297371
_resp = _resp.json()
298372
if _resp['success']:
299373
_logs = ''

‎model.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,10 @@ def __init__(self):
366366
self._page4_admin_list_btn = btn.new_with_label('显示任务')
367367
self._page4_admin_flush_btn = btn.new_with_label('删除所有任务')
368368
self._page4_clear_task_view_btn = btn.new_with_label('清空反馈的结果')
369+
self._page4_username_label = label.new('用户名:')
370+
self._page4_username_entry = et()
371+
self._page4_password_label = label.new('密码:')
372+
self._page4_password_entry = et()
369373
self._page4_option_get_entry = et()
370374
self._page4_option_set_view = tv()
371375
self._page4_task_view = tv()

‎screenshots/sqlmap-ui1.png‎

3.76 KB
Loading

‎screenshots/sqlmap-ui2.png‎

1.14 KB
Loading

‎screenshots/sqlmap-ui3.png‎

-3.35 KB
Loading

‎screenshots/sqlmap-ui4.png‎

3.48 KB
Loading

‎screenshots/sqlmap-ui5.png‎

-3.52 KB
Loading

‎screenshots/sqlmap-ui6.png‎

-14.5 KB
Loading

‎screenshots/sqlmap-ui7.png‎

471 Bytes
Loading

0 commit comments

Comments
 (0)