Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit e9ab33e

Browse files
bdamelebdamele
committed
standalone REST API, code cleanup (#297)
1 parent d928cce commit e9ab33e

4 files changed

Lines changed: 59 additions & 76 deletions

File tree

‎_sqlmap.py‎

Lines changed: 9 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,9 @@
88
import bdb
99
import logging
1010
import os
11-
import StringIO
1211
import sys
1312
import time
1413
import traceback
15-
import types
1614
import warnings
1715

1816
warnings.filterwarnings(action="ignore", message=".*was already imported", category=UserWarning)
@@ -24,7 +22,6 @@
2422
from lib.core.common import getUnicode
2523
from lib.core.common import setPaths
2624
from lib.core.common import weAreFrozen
27-
from lib.core.convert import stdoutencode
2825
from lib.core.data import cmdLineOptions
2926
from lib.core.data import conf
3027
from lib.core.data import kb
@@ -35,18 +32,12 @@
3532
from lib.core.exception import SqlmapMissingDependence
3633
from lib.core.exception import SqlmapSilentQuitException
3734
from lib.core.exception import SqlmapUserQuitException
38-
from lib.core.log import FORMATTER
39-
from lib.core.log import LOGGER_HANDLER
40-
from lib.core.log import LOGGER_OUTPUT
4135
from lib.core.option import init
4236
from lib.core.profiling import profile
4337
from lib.core.settings import LEGAL_DISCLAIMER
44-
from lib.core.settings import RESTAPI_SERVER_PORT
4538
from lib.core.testing import smokeTest
4639
from lib.core.testing import liveTest
4740
from lib.parse.cmdline import cmdLineParser
48-
from lib.utils.restapi import restAPIRun
49-
from lib.utils.restapi import restAPISetup
5041

5142
def modulePath():
5243
"""
@@ -56,30 +47,6 @@ def modulePath():
5647

5748
return os.path.dirname(getUnicode(sys.executable if weAreFrozen() else __file__, sys.getfilesystemencoding()))
5849

59-
def restAPIServe():
60-
# Increase default logging level to debug for RESTful API
61-
logger.setLevel(logging.DEBUG)
62-
63-
# Enforce batch mode and disable coloring for RESTful API
64-
cmdLineOptions.batch = True
65-
cmdLineOptions.disableColoring = True
66-
67-
# Setup RESTful API
68-
restAPISetup(port=cmdLineOptions.restApiPort or RESTAPI_SERVER_PORT)
69-
70-
# Wrap logger stdout onto a custom file descriptor (LOGGER_OUTPUT)
71-
def emit(self, record):
72-
message = stdoutencode(FORMATTER.format(record))
73-
print >>LOGGER_OUTPUT, message.strip('\r')
74-
LOGGER_HANDLER.emit = types.MethodType(emit, LOGGER_HANDLER, type(LOGGER_HANDLER))
75-
76-
# Wrap standard output onto a custom file descriptor
77-
sys.stdout = StringIO.StringIO()
78-
#sys.stderr = StringIO.StringIO()
79-
80-
# Run RESTful API
81-
restAPIRun(port=cmdLineOptions.restApiPort or RESTAPI_SERVER_PORT)
82-
8350
def main():
8451
"""
8552
Main function of sqlmap when running from command line.
@@ -96,19 +63,16 @@ def main():
9663
# Store original command line options for possible later restoration
9764
cmdLineOptions.update(cmdLineParser().__dict__)
9865

99-
if cmdLineOptions.restApi:
100-
restAPIServe()
66+
init(cmdLineOptions)
67+
68+
if conf.profile:
69+
profile()
70+
elif conf.smokeTest:
71+
smokeTest()
72+
elif conf.liveTest:
73+
liveTest()
10174
else:
102-
init(cmdLineOptions)
103-
104-
if conf.profile:
105-
profile()
106-
elif conf.smokeTest:
107-
smokeTest()
108-
elif conf.liveTest:
109-
liveTest()
110-
else:
111-
start()
75+
start()
11276

11377
except SqlmapUserQuitException:
11478
errMsg = "user quit"

‎lib/core/settings.py‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -482,9 +482,6 @@
482482
# Number of rows to generate inside the full union test for limited output (mustn't be too large to prevent payload length problems)
483483
LIMITED_ROWS_TEST_NUMBER = 15
484484

485-
# Default TCP port used for REST API server instance
486-
RESTAPI_SERVER_PORT = 8775
487-
488485
# Regular expression for SOAP-like POST data
489486
SOAP_RECOGNITION_REGEX = r"(?s)\A(<\?xml[^>]+>)?\s*<([^> ]+)( [^>]+)?>.+</\2.*>\s*\Z"
490487

‎lib/parse/cmdline.py‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -684,12 +684,6 @@ def cmdLineParser():
684684

685685
parser.add_option("--run-case", dest="runCase", help=SUPPRESS_HELP)
686686

687-
parser.add_option("--restapi", dest="restApi", action="store_true",
688-
help=SUPPRESS_HELP)
689-
690-
parser.add_option("--restapi-port", dest="restApiPort", type="int",
691-
help=SUPPRESS_HELP)
692-
693687
parser.add_option_group(target)
694688
parser.add_option_group(request)
695689
parser.add_option_group(optimization)
@@ -763,7 +757,7 @@ def _(self, *args):
763757

764758
if not any((args.direct, args.url, args.logFile, args.bulkFile, args.googleDork, args.configFile, \
765759
args.requestFile, args.updateAll, args.smokeTest, args.liveTest, args.wizard, args.dependencies, \
766-
args.restApi, args.purgeOutput)):
760+
args.purgeOutput)):
767761
errMsg = "missing a mandatory option (-d, -u, -l, -m, -r, -g, -c, --wizard, --update, --purge-output or --dependencies), "
768762
errMsg += "use -h for basic or -hh for advanced help"
769763
parser.error(errMsg)

lib/utils/restapi.py renamed to lib/utils/api.py

Lines changed: 49 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,15 @@
66
"""
77

88
import json
9+
import logging
910
import optparse
1011
import os
1112
import shutil
1213
import sys
14+
import StringIO
1315
import tempfile
1416
import threading
15-
16-
sys.path.append(os.path.join(os.path.abspath(os.path.dirname(__file__)), "..", ".."))
17+
import types
1718

1819
from extra.bottle.bottle import abort
1920
from extra.bottle.bottle import error
@@ -26,17 +27,24 @@
2627
from extra.bottle.bottle import static_file
2728
from extra.bottle.bottle import template
2829
from lib.controller.controller import start
30+
from lib.core.common import setPaths
2931
from lib.core.convert import hexencode
32+
from lib.core.convert import stdoutencode
3033
from lib.core.data import paths
3134
from lib.core.datatype import AttribDict
3235
from lib.core.data import cmdLineOptions
3336
from lib.core.data import kb
3437
from lib.core.data import logger
38+
from lib.core.log import FORMATTER
39+
from lib.core.log import LOGGER_HANDLER
3540
from lib.core.log import LOGGER_OUTPUT
3641
from lib.core.exception import SqlmapMissingDependence
3742
from lib.core.option import init
3843
from lib.core.settings import UNICODE_ENCODING
39-
from lib.core.settings import RESTAPI_SERVER_PORT
44+
from _sqlmap import modulePath
45+
46+
RESTAPI_SERVER_HOST = "127.0.0.1"
47+
RESTAPI_SERVER_PORT = 8775
4048

4149
# Local global variables
4250
adminid = ""
@@ -238,6 +246,8 @@ def scan_start(taskid):
238246
for key, value in request.json.items():
239247
tasks[taskid][key] = value
240248

249+
print "TASKS:", tasks
250+
241251
# Overwrite output directory (oDir) value to a temporary directory
242252
tasks[taskid].oDir = tempfile.mkdtemp(prefix="sqlmap-")
243253

@@ -317,9 +327,9 @@ def download(taskid, target, filename):
317327
else:
318328
abort(500)
319329

320-
def restAPISetup(host="0.0.0.0", port=RESTAPI_SERVER_PORT):
330+
def restAPIRun(host="0.0.0.0", port=RESTAPI_SERVER_PORT):
321331
"""
322-
Setup REST-JSON API
332+
REST-JSON API server
323333
"""
324334
global adminid
325335
global tasks
@@ -330,38 +340,56 @@ def restAPISetup(host="0.0.0.0", port=RESTAPI_SERVER_PORT):
330340
logger.info("running REST-JSON API server at '%s:%d'.." % (host, port))
331341
logger.info("the admin task ID is: %s" % adminid)
332342

333-
def restAPIRun(host="0.0.0.0", port=RESTAPI_SERVER_PORT):
334-
"""
335-
Run REST-JSON API
336-
"""
343+
# Wrap logger stdout onto a custom file descriptor (LOGGER_OUTPUT)
344+
def emit(self, record):
345+
message = stdoutencode(FORMATTER.format(record))
346+
print >>LOGGER_OUTPUT, message.strip('\r')
347+
348+
LOGGER_HANDLER.emit = types.MethodType(emit, LOGGER_HANDLER, type(LOGGER_HANDLER))
349+
350+
# Wrap standard output onto a custom file descriptor
351+
sys.stdout = StringIO.StringIO()
352+
#sys.stderr = StringIO.StringIO()
353+
354+
# Run RESTful API
337355
run(host=host, port=port, quiet=False, debug=False)
338356

339-
def client(host, port):
357+
def client(host=RESTAPI_SERVER_HOST, port=RESTAPI_SERVER_PORT):
340358
"""
341359
REST-JSON API client
342360
"""
343361
addr = "http://%s:%d" % (host, port)
344-
print "[*] starting debug REST-JSON client to '%s'..." % addr
362+
logger.info("starting debug REST-JSON client to '%s'..." % addr)
345363

346-
# TODO: write a simple client with urllib2, for now use curl from command line
347-
print "[!] not yet implemented, use curl from command line instead for now, for example:"
348-
print "\n\t$ curl --proxy http://127.0.0.1:8080 http://127.0.0.1:%s/task/new" % port
349-
print "\t$ curl --proxy http://127.0.0.1:8080 -H \"Content-Type: application/json\" -X POST -d '{\"url\": \"http://testphp.vulnweb.com/artists.php?artist=1\"}' http://127.0.0.1:%d/scan/<taskID>/start" % port
350-
print "\t$ curl --proxy http://127.0.0.1:8080 http://127.0.0.1:8775/scan/<taskID>/output"
351-
print "\t$ curl --proxy http://127.0.0.1:8080 http://127.0.0.1:8775/scan/<taskID>/log\n"
364+
# TODO: write a simple client with requests, for now use curl from command line
365+
logger.error("not yet implemented, use curl from command line instead for now, for example:")
366+
print "\n\t$ curl http://%s:%d/task/new" % (host, port)
367+
print "\t$ curl -H \"Content-Type: application/json\" -X POST -d '{\"url\": \"http://testphp.vulnweb.com/artists.php?artist=1\"}' http://%s:%d/scan/:taskid/start" % (host, port)
368+
print "\t$ curl http://%s:%d/scan/:taskid/output" % (host, port)
369+
print "\t$ curl http://%s:%d/scan/:taskid/log\n" % (host, port)
352370

353371
if __name__ == "__main__":
354372
"""
355-
REST-JSON API wrapper function
373+
REST-JSON API main function
356374
"""
375+
# Set default logging level to debug
376+
logger.setLevel(logging.DEBUG)
377+
378+
paths.SQLMAP_ROOT_PATH = modulePath()
379+
setPaths()
380+
381+
# Enforce batch mode and disable coloring
382+
cmdLineOptions.batch = True
383+
cmdLineOptions.disableColoring = True
384+
357385
parser = optparse.OptionParser()
358386
parser.add_option("-s", "--server", help="Act as a REST-JSON API server", default=RESTAPI_SERVER_PORT, action="store_true")
359387
parser.add_option("-c", "--client", help="Act as a REST-JSON API client", default=RESTAPI_SERVER_PORT, action="store_true")
360-
parser.add_option("-H", "--host", help="Host of the REST-JSON API server", default="0.0.0.0", action="store")
361-
parser.add_option("-p", "--port", help="Port of the the REST-JSON API server", default=RESTAPI_SERVER_PORT, action="store")
388+
parser.add_option("-H", "--host", help="Host of the REST-JSON API server", default=RESTAPI_SERVER_HOST, action="store")
389+
parser.add_option("-p", "--port", help="Port of the the REST-JSON API server", default=RESTAPI_SERVER_PORT, type="int", action="store")
362390
(args, _) = parser.parse_args()
363391

364392
if args.server is True:
365-
restAPIrun(args.host, args.port)
393+
restAPIRun(args.host, args.port)
366394
elif args.client is True:
367395
client(args.host, args.port)

0 commit comments

Comments
 (0)