Burpsuit結合SQLMapAPI產生的批量注入插件是怎樣的

這篇文章給大家介紹Burpsuit結合SQLMapAPI產生的批量注入插件是怎樣的，內容非常詳細，感興趣的小伙伴們可以參考借鑒，希望對大家能有所幫助。

1.1變動：

增加過濾設置

優化顯示結果

增加運行提示信息

增加域名正則匹配 

整個插件分為三個面板：任務面板、sqlmapapi參數配置面板、過濾條件面板。

任務面板

Server ： SQLmapapi服務的IP和端口

THREAD：同時檢測的任務數量

Domain：需要檢測的域名，支持正則匹配

CLEAN：清除任務緩存列表

TEST：測試SQLmapapi的連接是否成功

START：開啟檢測    

左下為任務列表和任務狀態，右側按鈕下方是信息提示區域，下方為請求詳情和掃描結果。

sqlmapapi參數配置面板

這里的設置參考sqlmap的參數設置。

Tamper：列表中的是sqlmap自帶的tamper，輸入框中可填入自定義的tamper使用 ”,“逗號分割 。

LogFile：設置掃描日志記錄文件，該文文件存儲路徑為sqlmapapi服務器上的路徑。

過濾條件面板

ExcludeSuffix：用來排除一些指定后綴的請求，使用正則進行匹配。例如：圖片、css、js等。

IngoreCase：對ExcludeSuffix進行限制是否區分大小寫，默認為不區分。

IngoreParams：在對請求進行重復性檢測時需要忽略的參數，使用”,“逗號分割，例如：請求中的隨機數timeStamp等。

ExcludeParams：在對請求進行過濾時如果存在該參數則不將該請求加入待測列表，例如：驗證碼checkCode等。

以上是根據這段時間在實際使用的過程中所做的一些修改，后續還會根據大家的建議進一步對該插件進行優化，謝謝大家的支持。

以下是程序中的一些代碼以及實現思路：

請求監聽段實現代碼

public void processHttpMessage(int toolFlag, boolean messageIsRequest, IHttpRequestResponse messageInfo) {
        boolean addFlag = false;// 是否添加到掃描列表
        // 判斷是否為request請求、開關是否打開
        if (messageIsRequest && sqlmapApiPanel.isStart()) {
            String host = helpers.analyzeRequest(messageInfo).getUrl().getHost();
            if (host.matches(targetDomian)) {
                IRequestInfo iRequestInfo = helpers.analyzeRequest(messageInfo);
                // 從？號處截斷URL 可區分http 和 https
                String url = String.valueOf(iRequestInfo.getUrl());
                url = url.indexOf("?") > 0 ? url.substring(0, url.indexOf("?")) : url;
                // 排除指定后綴URL(eg : .jpg|.png|.ico)
                if (!excludeSuffix.matcher(url).matches()) {
                    // 構造任務實體
                    TaskEntity entity = new TaskEntity(iRequestInfo.getUrl(), //
                            iRequestInfo.getMethod(), //
                            callbacks.saveBuffersToTempFiles(messageInfo), //
                            iRequestInfo);
                    // 進行數據去重檢測
                    String hash = bCrypt.hashpw(entity.getSignString(-1, ingoreParams), SALT);
                    Integer repeatCheckValue = 1;
                    if (String.valueOf(iRequestInfo.getHeaders()).indexOf("Chris-To-Sqlmap") != -1) {
                        if (repeatCheck.containsKey(hash)) {
                            repeatCheckValue = repeatCheck.get(hash) + 1;
                            hash = hash + repeatCheckValue;
                        }
                        addFlag = true;
                    }
                    // 檢測當前數據包是否重復，檢測當前數據包是否要根據參數可選過濾
                    else if (!repeatCheck.containsKey(hash) && !entity.hasParams(excludeParams)) {
                        // repeatCheck
                        if (!entity.getParamBody().isEmpty()) {// 檢測post參數是否為空
                            addFlag = true;
                        } else if (!entity.getParamUrl().isEmpty()) {// 檢測get參數是否為空
                            addFlag = true;
                        } else if (sqlmapApiOption.getLevel() >= 3 && !entity.getParamCookie().isEmpty()) {// level參數大于3是應檢測cookie注入
                            addFlag = true;
                        }
                    }
                    if (addFlag) {
                        int row = listTasks.size();
                        repeatCheck.put(hash, repeatCheckValue);
                        listTasks.add(entity);
                        fireTableRowsInserted(row, listTasks.size());
                    }
                }
            }
        }
    }

任務執行段實現代碼：

public void run() {
                while (true) {
                    if (!threadFlag) {
                        try {
                            sqlmapApiPanel.setMessage("Waiting.");
                            sleep(3 * 1000);
                        } catch (InterruptedException e) {
                            stderr.print(e.getMessage());
                        }
                        continue;
                    }
                    // 增加任務
                    if (runingTasks.size() < THREAD_NUMBER && listTasks_start < listTasks.size()) {
                        while (runingTasks.size() < THREAD_NUMBER && listTasks_start < listTasks.size()) {
                            TaskEntity entityNew = listTasks.get(listTasks_start);
                            entityNew.setTaskid(sqlmapapi.tastNew(sqlmapapiServer));
                            if (entityNew.getTaskid() != "" && entityNew.getTaskid() != "-") {
                                entityNew.setTaskEngineid(sqlmapapi.taskStart(sqlmapapiServer, entityNew, sqlmapApiOption));
                                runingTasks.put(entityNew.getTaskid(), entityNew);
                                sqlmapApiPanel.setMessage("New task "+entityNew.getTaskid()+" , URL :"+String.valueOf(entityNew.getUrl())+"    .");
                                listTasks_start++;
                            } else {
                                try {
                                    sqlmapApiPanel.setMessage("New task failed! URL :"+String.valueOf(entityNew.getUrl())+"    .");
                                    sleep(3 * 1000);
                                } catch (InterruptedException e) {
                                    stderr.print(e.getMessage());
                                }
                                continue;
                            }
                        }
                    }
                    if (runingTasks.size() != 0) {
                        // 刷新map中任務的狀態
                        List<String> removeList = new ArrayList<>();
                        for (String key : runingTasks.keySet()) {
                            TaskEntity entityRuning = runingTasks.get(key);
                            String status = sqlmapapi.flushStatus(sqlmapapiServer, entityRuning);
                            sqlmapApiPanel.setMessage("Flash task [" + key + "] " + status + " .");
                            if ("terminated".equals(status)) {
                                entityRuning.setTaskStatus(status);
                                entityRuning.setTaskScanData(sqlmapapi.flushScanData(sqlmapapiServer, entityRuning));
                                sqlmapApiPanel.setMessage("Task [" + key + "] finished .");
                                removeList.add(key);
                            } else if ("not running".equals(status)) {
                                stderr.println(entityRuning.getTaskid() + " not running");
                                // entityRuning.setTaskEngineid(taskStart(entityRuning));
                            } else {
                                entityRuning.setTaskStatus(status);
                            }
                            try {
                                sleep(3 * 1000);
                            } catch (InterruptedException e) {
                                stderr.print(e.getMessage());
                            }
                        }
                        if (!removeList.isEmpty()) {
                            for (String key : removeList) {
                                runingTasks.remove(key);
                            }
                        }
                        fireTableRowsInserted(0, listTasks.size());
                    } else {
                        try {
                            sleep(3 * 1000);
                        } catch (InterruptedException e) {
                            stderr.print(e.getMessage());
                        }
                    }
                }
            }

關于Burpsuit結合SQLMapAPI產生的批量注入插件是怎樣的就分享到這里了，希望以上內容可以對大家有一定的幫助，可以學到更多知識。如果覺得文章不錯，可以把它分享出去讓更多的人看到。