Skip to content

Commit f9708b3

Browse files
lanshuizhiyuelanshuizhiyue
committed
feat: 支持解析所有SQLMap命令行参数，修复扫描配置显示问题
- Burp插件: 支持解析所有SQLMap命令行参数（除-r外），未识别的合法参数存入extraOptions - Burp插件: 版本号更新到1.8.14与Git tag同步 - 后端: 修复_get_task_scan_options_sync返回SQLMap默认值的问题 - 后端: 返回requestFile参数供前端显示完整命令 - 前端: 命令行视图显示完整命令 python sqlmap.py，支持语法高亮 - 前端: 参数格式遵循sqlmap帮助文档（短参数空格分隔，长参数等号连接） - 前端: 驼峰命名自动转换为kebab-case（如textOnly -> --text-only） - 前端: 复制命令包含完整python sqlmap.py前缀
1 parent 8b5401b commit f9708b3

File tree

15 files changed

+1351
-379
lines changed

15 files changed

+1351
-379
lines changed

‎src/backEnd/doc/sqlmap_cmd_help_doc.txt‎

Lines changed: 297 additions & 0 deletions
Large diffs are not rendered by default.

‎src/backEnd/service/taskService.py‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
from third_lib.sqlmap.lib.core.settings import RESTAPI_UNSUPPORTED_OPTIONS
2020
from third_lib.sqlmap.lib.core.convert import encodeHex
2121
from third_lib.sqlmap.lib.core.data import logger
22+
from third_lib.sqlmap.lib.core.defaults import _defaults as SQLMAP_DEFAULTS
2223
from utils.content_type_helper import get_content_type_by_number
2324

2425

@@ -541,23 +542,38 @@ async def get_task_http_request_info(self, taskId):
541542

542543
def _get_task_scan_options_sync(self, taskId: str):
543544
"""同步获取扫描选项（在线程池中执行）"""
545+
# 不应该返回给前端的内部选项
546+
INTERNAL_OPTIONS = {'api', 'taskid', 'database', 'disableColoring', 'eta', 'headers'}
547+
544548
with DataStore.tasks_lock:
545549
if taskId not in DataStore.tasks:
546550
return (None, False, "task not found", status.HTTP_404_NOT_FOUND)
547551
task = DataStore.tasks[taskId]
548552
task_options = task.get_options()
549553
res_options = []
550554
for option in task_options:
555+
# 跳过内部选项
556+
if option in INTERNAL_OPTIONS:
557+
continue
558+
551559
option_value = task_options[option]
552-
if option_value is not None:
553-
if isinstance(option_value, list) and len(option_value) > 0:
554-
res_options.append({"option": option, "value": option_value})
555-
elif isinstance(option_value, bool) and option_value is True:
556-
res_options.append({"option": option, "value": option_value})
557-
elif isinstance(option_value, str) and len(option_value) > 0:
558-
res_options.append({"option": option, "value": option_value})
559-
elif isinstance(option_value, int) and option_value > 0:
560-
res_options.append({"option": option, "value": option_value})
560+
if option_value is None:
561+
continue
562+
563+
# 跳过与 SQLMap 默认值相同的选项（用户没有显式设置的）
564+
default_value = SQLMAP_DEFAULTS.get(option)
565+
if default_value is not None and option_value == default_value:
566+
continue
567+
568+
# 只返回有意义的非默认值
569+
if isinstance(option_value, list) and len(option_value) > 0:
570+
res_options.append({"option": option, "value": option_value})
571+
elif isinstance(option_value, bool) and option_value is True:
572+
res_options.append({"option": option, "value": option_value})
573+
elif isinstance(option_value, str) and len(option_value) > 0:
574+
res_options.append({"option": option, "value": option_value})
575+
elif isinstance(option_value, (int, float)) and option_value > 0:
576+
res_options.append({"option": option, "value": option_value})
561577
data = {
562578
"taskid": taskId,
563579
"options": res_options,

‎src/burpEx/legacy-api/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
<groupId>com.sqlmapwebui</groupId>
88
<artifactId>sqlmap-webui-burp-legacy</artifactId>
9-
<version>1.0.0</version>
9+
<version>1.8.14</version>
1010
<packaging>jar</packaging>
1111

1212
<name>SQLMap WebUI Burp Extension (Legacy API)</name>

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/ConfigManager.java‎

Lines changed: 16 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -285,10 +285,22 @@ public ScanConfig getSelectedScanConfig() {
285285
if (presetDatabase != null && selectedPresetName != null) {
286286
PresetConfig presetConfig = presetDatabase.getConfigByName(selectedPresetName);
287287
if (presetConfig != null) {
288-
ScanConfig config = ScanConfig.createDefault();
289-
config.setName(presetConfig.getName());
290-
parseArgsToConfig(presetConfig.getParameterString(), config);
291-
return config;
288+
String paramString = presetConfig.getParameterString();
289+
if (paramString != null && !paramString.trim().isEmpty()) {
290+
// 使用完整的ScanConfigParser解析参数字符串
291+
ParseResult result = ScanConfigParser.parse(paramString);
292+
if (result.isSuccess() && result.getConfig() != null) {
293+
ScanConfig config = result.getConfig();
294+
config.setName(presetConfig.getName());
295+
config.setDescription(presetConfig.getDescription());
296+
return config;
297+
}
298+
}
299+
// 如果参数字符串为空或解析失败，返回默认配置但保留名称
300+
ScanConfig fallback = ScanConfig.createDefault();
301+
fallback.setName(presetConfig.getName());
302+
fallback.setDescription(presetConfig.getDescription());
303+
return fallback;
292304
}
293305
}
294306
// 如果数据库不可用，尝试从内存列表获取
@@ -314,36 +326,6 @@ public ScanConfig getSelectedScanConfig() {
314326
}
315327
}
316328

317-
/**
318-
* 解析参数字符串到ScanConfig
319-
*/
320-
private void parseArgsToConfig(String argsStr, ScanConfig config) {
321-
if (argsStr == null || argsStr.isEmpty()) return;
322-
323-
String[] parts = argsStr.split("\\s+");
324-
for (String part : parts) {
325-
if (part.startsWith("--level=")) {
326-
try {
327-
config.setLevel(Integer.parseInt(part.substring(8)));
328-
} catch (NumberFormatException ignored) {}
329-
} else if (part.startsWith("--risk=")) {
330-
try {
331-
config.setRisk(Integer.parseInt(part.substring(7)));
332-
} catch (NumberFormatException ignored) {}
333-
} else if (part.startsWith("--dbms=")) {
334-
config.setDbms(part.substring(7));
335-
} else if (part.startsWith("--technique=")) {
336-
config.setTechnique(part.substring(12));
337-
} else if (part.startsWith("--proxy=")) {
338-
config.setProxy(part.substring(8));
339-
} else if (part.equals("--force-ssl")) {
340-
config.setForceSSL(true);
341-
} else if (part.equals("--batch")) {
342-
config.setBatch(true);
343-
}
344-
}
345-
}
346-
347329
// ============ 连接状态管理 ============
348330

349331
public boolean isConnected() {

‎src/burpEx/legacy-api/src/main/java/com/sqlmapwebui/burp/ScanConfig.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,10 @@ public class ScanConfig {
8888
private boolean freshQueries = false; // --fresh-queries
8989
private int verbose = 1; // -v/--verbose (0-6)
9090

91+
// ==================== 额外参数（支持任意SQLMap参数）====================
92+
private String extraArgs = ""; // 存储所有未被识别的参数，原样传递给后端
93+
private Map<String, Object> extraOptions = new HashMap<>(); // 存储解析后的额外参数，传递给后端
94+
9195
// ==================== 元数据 ====================
9296
private long createdAt;
9397
private long lastUsedAt;
@@ -290,6 +294,21 @@ public ScanConfig(String name) {
290294
public int getVerbose() { return verbose; }
291295
public void setVerbose(int verbose) { this.verbose = Math.max(0, Math.min(6, verbose)); }
292296

297+
// Extra Args
298+
public String getExtraArgs() { return extraArgs; }
299+
public void setExtraArgs(String extraArgs) { this.extraArgs = extraArgs != null ? extraArgs : ""; }
300+
301+
// Extra Options
302+
public Map<String, Object> getExtraOptions() { return extraOptions; }
303+
public void setExtraOptions(Map<String, Object> extraOptions) {
304+
this.extraOptions = extraOptions != null ? extraOptions : new HashMap<>();
305+
}
306+
public void addExtraOption(String key, Object value) {
307+
if (key != null && !key.isEmpty()) {
308+
this.extraOptions.put(key, value);
309+
}
310+
}
311+
293312
// Metadata
294313
public long getCreatedAt() { return createdAt; }
295314
public void setCreatedAt(long createdAt) { this.createdAt = createdAt; }
@@ -380,6 +399,11 @@ public Map<String, Object> toOptionsMap() {
380399
if (freshQueries) options.put("freshQueries", true);
381400
if (verbose != 1) options.put("verbose", verbose);
382401

402+
// Extra Options - 支持任意额外的SQLMap参数
403+
if (extraOptions != null && !extraOptions.isEmpty()) {
404+
options.putAll(extraOptions);
405+
}
406+
383407
return options;
384408
}
385409

@@ -463,6 +487,10 @@ public ScanConfig copy() {
463487
copy.freshQueries = this.freshQueries;
464488
copy.verbose = this.verbose;
465489

490+
// Extra
491+
copy.extraArgs = this.extraArgs;
492+
copy.extraOptions = new HashMap<>(this.extraOptions);
493+
466494
// Metadata
467495
copy.createdAt = System.currentTimeMillis();
468496
copy.lastUsedAt = copy.createdAt;

0 commit comments

Comments
 (0)