Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 23ff1ca

Browse files
stamparmstamparm
committed
Adding SQLi vulnserver (for testing purposes)
1 parent dbd93e2 commit 23ff1ca

3 files changed

Lines changed: 158 additions & 2 deletions

File tree

‎extra/vulnserver/__init__.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
5+
See the file 'LICENSE' for copying permission
6+
"""
7+
8+
pass

‎extra/vulnserver/vulnserver.py‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
#!/usr/bin/env python
2+
3+
"""
4+
vulnserver.py - Trivial SQLi vulnerable HTTP server (Note: for testing purposes)
5+
6+
Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
7+
See the file 'LICENSE' for copying permission
8+
"""
9+
10+
from __future__ import print_function
11+
12+
import re
13+
import sqlite3
14+
import sys
15+
import traceback
16+
17+
if sys.version_info >= (3, 0):
18+
from http.client import FOUND
19+
from http.client import NOT_FOUND
20+
from http.client import OK
21+
from http.server import BaseHTTPRequestHandler
22+
from http.server import HTTPServer
23+
from socketserver import ThreadingMixIn
24+
from urllib.parse import parse_qs
25+
from urllib.parse import unquote_plus
26+
else:
27+
from BaseHTTPServer import BaseHTTPRequestHandler
28+
from BaseHTTPServer import HTTPServer
29+
from httplib import FOUND
30+
from httplib import NOT_FOUND
31+
from httplib import OK
32+
from SocketServer import ThreadingMixIn
33+
from urlparse import parse_qs
34+
from urllib import unquote_plus
35+
36+
SCHEMA = """
37+
CREATE TABLE users (
38+
id INTEGER,
39+
name TEXT,
40+
surname TEXT
41+
);
42+
INSERT INTO users (id, name, surname) VALUES (1, 'luther', 'blisset');
43+
INSERT INTO users (id, name, surname) VALUES (2, 'fluffy', 'bunny');
44+
INSERT INTO users (id, name, surname) VALUES (3, 'wu', 'ming');
45+
INSERT INTO users (id, name, surname) VALUES (4, 'sqlmap/1.0-dev (http://sqlmap.org)', 'user agent header');
46+
INSERT INTO users (id, name, surname) VALUES (5, NULL, 'nameisnull');
47+
"""
48+
49+
LISTEN_ADDRESS = "localhost"
50+
LISTEN_PORT = 8440
51+
52+
_conn = None
53+
_cursor = None
54+
_server = None
55+
56+
def init():
57+
global _conn
58+
global _cursor
59+
60+
_conn = sqlite3.connect(":memory:", isolation_level=None, check_same_thread=False)
61+
_cursor = _conn.cursor()
62+
63+
_cursor.executescript(SCHEMA)
64+
65+
class ThreadingServer(ThreadingMixIn, HTTPServer):
66+
def finish_request(self, *args, **kwargs):
67+
try:
68+
HTTPServer.finish_request(self, *args, **kwargs)
69+
except Exception:
70+
traceback.print_exc()
71+
72+
class ReqHandler(BaseHTTPRequestHandler):
73+
def do_REQUEST(self):
74+
path, query = self.path.split('?', 1) if '?' in self.path else (self.path, "")
75+
params = {}
76+
77+
if query:
78+
params.update(parse_qs(query))
79+
80+
if hasattr(self, "data"):
81+
params.update(parse_qs(self.data))
82+
83+
for key in params:
84+
if params[key]:
85+
params[key] = params[key][-1]
86+
87+
self.url, self.params = path, params
88+
89+
if self.url == '/':
90+
if "id" not in params:
91+
self.send_response(FOUND)
92+
self.send_header("Connection", "close")
93+
self.send_header("Location", "/?id=1")
94+
self.end_headers()
95+
else:
96+
self.send_response(OK)
97+
self.send_header("Content-type", "text/html")
98+
self.send_header("Connection", "close")
99+
self.end_headers()
100+
101+
try:
102+
_cursor.execute("SELECT * FROM users WHERE id=%s LIMIT 0, 1" % self.params.get("id", ""))
103+
104+
output = "<b>SQL results:</b>\n"
105+
output += "<table border=\"1\">\n"
106+
for row in _cursor.fetchall():
107+
output += "<tr>"
108+
for value in row:
109+
output += "<td>%s</td>" % value
110+
output += "</tr>\n"
111+
output += "</table>\n"
112+
output += "</body></html>";
113+
except Exception as ex:
114+
output = "%s: %s" % (re.search(r"'([^']+)'", str(type(ex))).group(1), ex)
115+
116+
self.wfile.write(output.encode("utf8"))
117+
else:
118+
self.send_response(NOT_FOUND)
119+
self.send_header("Connection", "close")
120+
self.end_headers()
121+
122+
def do_GET(self):
123+
self.do_REQUEST()
124+
125+
def do_POST(self):
126+
length = int(self.headers.get("Content-length", 0))
127+
if length:
128+
data = self.rfile.read(length)
129+
data = unquote_plus(data.decode("utf8"))
130+
self.data = data
131+
self.do_REQUEST()
132+
133+
def run(address=LISTEN_ADDRESS, port=LISTEN_PORT):
134+
global _server
135+
try:
136+
_server = ThreadingServer((address, port), ReqHandler)
137+
print("[i] running HTTP server at '%s:%d'" % (address, port))
138+
_server.serve_forever()
139+
except KeyboardInterrupt:
140+
_server.socket.close()
141+
raise
142+
143+
if __name__ == "__main__":
144+
try:
145+
init()
146+
run(sys.argv[1] if len(sys.argv) > 1 else LISTEN_ADDRESS, int(sys.argv[2] if len(sys.argv) > 2 else LISTEN_PORT))
147+
except KeyboardInterrupt:
148+
print("\r[x] Ctrl-C received")

‎lib/core/settings.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
from lib.core.enums import OS
1818

1919
# sqlmap version (<major>.<minor>.<month>.<monthly commit>)
20-
VERSION = "1.3.3.78"
20+
VERSION = "1.3.3.79"
2121
TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
2222
TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
2323
VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -98,7 +98,7 @@
9898
PRECONNECT_CANDIDATE_TIMEOUT = 10
9999

100100
# Servers known to cause issue with pre-connection mechanism (because of lack of multi-threaded support)
101-
PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP",)
101+
PRECONNECT_INCOMPATIBLE_SERVERS = ("SimpleHTTP", "BaseHTTP")
102102

103103
# Maximum sleep time in "Murphy" (testing) mode
104104
MAX_MURPHY_SLEEP_TIME = 3

0 commit comments

Comments
 (0)