Skip to content

Commit 15b1d00

Browse files
needle-wangneedle-wang
committed
--live-cookies --csrf-retries --skip-heuristics --postprocess
1 parent d2a65cd commit 15b1d00

File tree

6 files changed

+57
-5
lines changed

6 files changed

+57
-5
lines changed

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ sqlmap已经移植到了python3.
2222

2323
#### 安装与使用
2424
1. **要求**
25-
- python3.6+, GTK+3.20以上(linux下已自带)
25+
- python3.6+, GTK+3.20以上(linux已自带)
2626
- pygobject: (二选一)
2727
- `apt-get install python3-gi`(推荐)
2828
- `pip3 install PyGObject`
@@ -49,4 +49,4 @@ sqlmap已经移植到了python3.
4949

5050
#### 参考文献
5151
- Python GTK+3教程: <https://python-gtk-3-tutorial.readthedocs.io/en/latest/>
52-
- PyGObject API: <https://lazka.github.io/pgi-docs/Gtk-3.0/>
52+
- PyGObject-GTK 3.0 API: <https://lazka.github.io/pgi-docs/Gtk-3.0/>

‎handlers.py‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,9 @@ def _collect_opts(self):
224224
self._get_text_from_entry("--preprocess=",
225225
m._page1_general_preprocess_ckbtn,
226226
m._page1_general_preprocess_entry),
227+
self._get_text_from_entry("--postprocess=",
228+
m._page1_general_postprocess_ckbtn,
229+
m._page1_general_postprocess_entry),
227230
self._get_text_from_entry("--charset=",
228231
m._page1_general_charset_ckbtn,
229232
m._page1_general_charset_entry),
@@ -271,6 +274,8 @@ def _collect_opts(self):
271274
self._get_text_from_entry("--output-dir=",
272275
m._page1_general_output_dir_ckbtn,
273276
m._page1_general_output_dir_entry),
277+
self._get_text_only_ckbtn("--skip-heuristics",
278+
m._page1_misc_skip_heuristics_ckbtn),
274279
self._get_text_only_ckbtn("--skip-waf",
275280
m._page1_misc_skip_waf_ckbtn),
276281
self._get_text_only_ckbtn("--unstable",
@@ -492,6 +497,9 @@ def _collect_opts(self):
492497
self._get_text_from_entry("--cookie-del=",
493498
m._request_area_cookie_del_ckbtn,
494499
m._request_area_cookie_del_entry),
500+
self._get_text_from_entry("--live-cookies=",
501+
m._request_area_live_cookies_ckbtn,
502+
m._request_area_live_cookies_entry),
495503
self._get_text_from_entry("--load-cookies=",
496504
m._request_area_load_cookies_ckbtn,
497505
m._request_area_load_cookies_entry),
@@ -509,6 +517,9 @@ def _collect_opts(self):
509517
self._get_text_from_entry("--csrf-method=",
510518
m._request_area_csrf_method_ckbtn,
511519
m._request_area_csrf_method_entry),
520+
self._get_text_from_entry("--csrf-retries=",
521+
m._request_area_csrf_retries_ckbtn,
522+
m._request_area_csrf_retries_entry),
512523
self._get_text_from_entry("--csrf-token=",
513524
m._request_area_csrf_token_ckbtn,
514525
m._request_area_csrf_token_entry),

‎model.py‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,9 @@ def __init__(self):
149149
self._request_area_cookie_entry = et()
150150
self._request_area_cookie_del_ckbtn = cb('指定cookie分隔符')
151151
self._request_area_cookie_del_entry = et(width_chars = 5)
152+
self._request_area_live_cookies_ckbtn = cb('live_cookies')
153+
self._request_area_live_cookies_entry = FileEntry()
154+
self._request_area_live_cookies_chooser = btn.new_with_label('打开')
152155
self._request_area_load_cookies_ckbtn = cb('本地Cookie文件')
153156
self._request_area_load_cookies_entry = FileEntry()
154157
self._request_area_load_cookies_chooser = btn.new_with_label('打开')
@@ -162,6 +165,8 @@ def __init__(self):
162165
self._request_area_auth_file_chooser = btn.new_with_label('打开')
163166
self._request_area_csrf_method_ckbtn = cb('csrf_method')
164167
self._request_area_csrf_method_entry = et(width_chars = 10)
168+
self._request_area_csrf_retries_ckbtn = cb('csrf_retries')
169+
self._request_area_csrf_retries_entry = NumberEntry()
165170
self._request_area_csrf_token_ckbtn = cb('csrf_token')
166171
self._request_area_csrf_token_entry = et()
167172
self._request_area_csrf_url_ckbtn = cb('获取csrf_token的url')
@@ -313,9 +318,12 @@ def __init__(self):
313318
self._page1_general_table_prefix_entry = et(width_chars = 15)
314319
self._page1_general_binary_fields_ckbtn = cb('有二进制值的字段')
315320
self._page1_general_binary_fields_entry = et()
316-
self._page1_general_preprocess_ckbtn = cb('指定预处理响应数据的脚本')
321+
self._page1_general_preprocess_ckbtn = cb('处理请求的脚本')
317322
self._page1_general_preprocess_entry = et()
318323
self._page1_general_preprocess_chooser = btn.new_with_label('打开')
324+
self._page1_general_postprocess_ckbtn = cb('处理响应的脚本')
325+
self._page1_general_postprocess_entry = et()
326+
self._page1_general_postprocess_chooser = btn.new_with_label('打开')
319327
self._page1_general_charset_ckbtn = cb('盲注所用的字符集合')
320328
self._page1_general_charset_entry = et(text = '0123456789abcdef')
321329
self._page1_general_encoding_ckbtn = cb('字符编码(用于数据获取)')
@@ -339,7 +347,7 @@ def __init__(self):
339347
self._page1_general_har_ckbtn = cb('转存至HAR文件')
340348
self._page1_general_har_entry = FileEntry()
341349
self._page1_general_har_chooser = btn.new_with_label('打开')
342-
self._page1_general_flush_session_ckbtn = cb('<b>清空目标的会话文件</b>')
350+
self._page1_general_flush_session_ckbtn = cb('<b>清空本地的目标session</b>')
343351
self._page1_general_dump_format_ckbtn = cb('dump结果的文件格式')
344352
self._page1_general_dump_format_entry = et(width_chars = 6)
345353
self._page1_general_csv_del_ckbtn = cb('(csv文件的)分隔符')
@@ -354,6 +362,7 @@ def __init__(self):
354362
self._page1_general_output_dir_entry = FileEntry()
355363
self._page1_general_output_dir_chooser = btn.new_with_label('打开')
356364
# 杂项
365+
self._page1_misc_skip_heuristics_ckbtn = cb('跳过SQLi/XSS侦测')
357366
self._page1_misc_skip_waf_ckbtn = cb('跳过WAF/IPS侦测')
358367
self._page1_misc_unstable_ckbtn = cb('为不稳定的连接调整选项')
359368
self._page1_misc_list_tampers_ckbtn = cb('列出可用的tamper脚本')

‎opts_gtk.py‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -439,12 +439,20 @@ def _build_page1_request_data(self, m):
439439
_boxes[3].pack_start(m._request_area_cookie_del_ckbtn, False, True, 5)
440440
_boxes[3].pack_start(m._request_area_cookie_del_entry, False, True, 5)
441441

442+
m._request_area_live_cookies_chooser.connect(
443+
'clicked',
444+
self._handlers.set_file_entry_text,
445+
[m._request_area_live_cookies_entry]
446+
)
442447
m._request_area_load_cookies_chooser.connect(
443448
'clicked',
444449
self._handlers.set_file_entry_text,
445450
[m._request_area_load_cookies_entry]
446451
)
447452

453+
_boxes[4].pack_start(m._request_area_live_cookies_ckbtn, False, True, 5)
454+
_boxes[4].pack_start(m._request_area_live_cookies_entry, True, True, 0)
455+
_boxes[4].pack_start(m._request_area_live_cookies_chooser, False, True, 5)
448456
_boxes[4].pack_start(m._request_area_load_cookies_ckbtn, False, True, 5)
449457
_boxes[4].pack_start(m._request_area_load_cookies_entry, True, True, 0)
450458
_boxes[4].pack_start(m._request_area_load_cookies_chooser, False, True, 5)
@@ -464,8 +472,13 @@ def _build_page1_request_data(self, m):
464472
_boxes[6].pack_start(m._request_area_auth_file_ckbtn, False, True, 5)
465473
_boxes[6].pack_start(m._request_area_auth_file_entry, True, True, 0)
466474
_boxes[6].pack_start(m._request_area_auth_file_chooser, False, True, 5)
475+
476+
m._request_area_csrf_retries_entry.set_width_chars(5)
477+
467478
_boxes[7].pack_start(m._request_area_csrf_method_ckbtn, False, True, 5)
468479
_boxes[7].pack_start(m._request_area_csrf_method_entry, False, True, 5)
480+
_boxes[7].pack_start(m._request_area_csrf_retries_ckbtn, False, True, 5)
481+
_boxes[7].pack_start(m._request_area_csrf_retries_entry, False, True, 5)
469482
_boxes[7].pack_start(m._request_area_csrf_token_ckbtn, False, True, 5)
470483
_boxes[7].pack_start(m._request_area_csrf_token_entry, True, True, 5)
471484
_boxes[7].pack_start(m._request_area_csrf_url_ckbtn, False, True, 5)
@@ -954,6 +967,9 @@ def _build_page1_other_general(self, m):
954967
_boxes[1].pack_start(m._page1_general_preprocess_ckbtn, False, True, 5)
955968
_boxes[1].pack_start(m._page1_general_preprocess_entry, True, True, 0)
956969
_boxes[1].pack_start(m._page1_general_preprocess_chooser, False, True, 5)
970+
_boxes[1].pack_start(m._page1_general_postprocess_ckbtn, False, True, 5)
971+
_boxes[1].pack_start(m._page1_general_postprocess_entry, True, True, 0)
972+
_boxes[1].pack_start(m._page1_general_postprocess_chooser, False, True, 5)
957973
_boxes[2].pack_start(m._page1_general_charset_ckbtn, False, True, 5)
958974
_boxes[2].pack_start(m._page1_general_charset_entry, True, True, 5)
959975
_boxes[2].pack_start(m._page1_general_encoding_ckbtn, False, True, 5)
@@ -1052,6 +1068,7 @@ def _build_page1_other_misc(self, m):
10521068

10531069
m._page1_misc_purge_ckbtn.get_children()[0].set_use_markup(True)
10541070

1071+
_boxes[0].pack_start(m._page1_misc_skip_heuristics_ckbtn, False, True, 5)
10551072
_boxes[0].pack_start(m._page1_misc_skip_waf_ckbtn, False, True, 5)
10561073
_boxes[0].pack_start(m._page1_misc_unstable_ckbtn, False, True, 5)
10571074
_boxes[0].pack_start(m._page1_misc_list_tampers_ckbtn, False, True, 5)

‎sqlmap_gtk.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -600,7 +600,7 @@ def _build_page6(self):
600600
2. 使用PyGObject(python3-gi + Gtk+3)重写sqm.py
601601
3. 感谢sqm带来的灵感, 其作者: <a href="{_url_idea}" title="{_url_idea}">KINGX</a>, sqm UI 使用的是python2 + tkinter\n
602602
4. Python GTK+3教程: <a href="{_url_tutorial}">{_url_tutorial}</a>
603-
5. PyGObject API: <a href="{_url_api}">{_url_api}</a>
603+
5. PyGObject-GTK 3.0 API: <a href="{_url_api}">{_url_api}</a>
604604
'''
605605
_ = label.new(_about_str)
606606
_.set_use_markup(True)

‎tooltips.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ def set_all_placeholders(self, m):
8282
m._request_area_auth_file_entry)
8383
self._set_placeholder('post',
8484
m._request_area_csrf_method_entry)
85+
self._set_placeholder('0',
86+
m._request_area_csrf_retries_entry)
8587
self._set_placeholder('token字段名',
8688
m._request_area_csrf_token_entry)
8789
self._set_placeholder('import hashlib;id2=hashlib.md5(id).hexdigest()',
@@ -332,6 +334,9 @@ def set_all_tooltips(self, m):
332334
self._set_tooltip('--cookie-del=',
333335
m._request_area_cookie_del_ckbtn,
334336
m._request_area_cookie_del_entry)
337+
self._set_tooltip('--live-cookies=',
338+
m._request_area_live_cookies_ckbtn,
339+
m._request_area_live_cookies_entry)
335340
self._set_tooltip('--load-cookies=',
336341
m._request_area_load_cookies_ckbtn,
337342
m._request_area_load_cookies_entry)
@@ -350,6 +355,10 @@ def set_all_tooltips(self, m):
350355
self._set_tooltip('--csrf-method=',
351356
m._request_area_csrf_method_ckbtn,
352357
m._request_area_csrf_method_entry)
358+
self._set_tooltip('--csrf-retries=\n'
359+
'Retries for anti-CSRF token retrieval (default 0)',
360+
m._request_area_csrf_retries_ckbtn,
361+
m._request_area_csrf_retries_entry)
353362
self._set_tooltip('--csrf-token=\n'
354363
'如果表单中含有隐藏的随机token字段(用来防止csrf攻击的),\n'
355364
'使用此选项.',
@@ -644,6 +653,9 @@ def set_all_tooltips(self, m):
644653
self._set_tooltip('--preprocess=',
645654
m._page1_general_preprocess_ckbtn,
646655
m._page1_general_preprocess_entry)
656+
self._set_tooltip('--postprocess=',
657+
m._page1_general_postprocess_ckbtn,
658+
m._page1_general_postprocess_entry)
647659
self._set_tooltip('--charset= 如获取SHA1密文时, 请求数可减小30%',
648660
m._page1_general_charset_ckbtn,
649661
m._page1_general_charset_entry)
@@ -691,6 +703,9 @@ def set_all_tooltips(self, m):
691703
self._set_tooltip('--output-dir=',
692704
m._page1_general_output_dir_ckbtn,
693705
m._page1_general_output_dir_entry)
706+
self._set_tooltip('--skip-heuristics\n'
707+
'Skip heuristic detection of SQLi/XSS vulnerabilities',
708+
m._page1_misc_skip_heuristics_ckbtn)
694709
self._set_tooltip('--skip-waf\n'
695710
'默认情况, 会发送一个可疑的payload(所以有时明显没有防护还报警告)\n'
696711
'勾选以禁用此默认机制',

0 commit comments

Comments
 (0)