├── .gitognore ├── Autosqli.py ├── DATABASE ├── Autosqli.db └── schema.sql ├── README.md ├── lxml-2.3.win-amd64-py2.7.exe ├── readme_pic ├── 1.png ├── 1pa_data.png ├── 2.png ├── 2pa_data1.png ├── 2pa_data2.png ├── 2pa_data3.png └── 3.png ├── requirements.txt ├── set_options.txt ├── static ├── css │ ├── global.css │ ├── json.css │ ├── normal.css │ └── zxmk.css ├── images │ ├── Collapsed.gif │ ├── Expanded.gif │ ├── Thumbs.db │ ├── admin.jpg │ ├── bg.png │ ├── bg2.png │ ├── chart.png │ ├── course-icon.png │ ├── course-icon2.png │ ├── favicon.ico │ ├── forma-icon.png │ ├── jxst.png │ ├── means-icon.png │ ├── mryl.png │ ├── quest-icon.png │ ├── quest-icon2.png │ ├── report-icon.png │ ├── xx-logo.jpg │ ├── yl.png │ └── zlDown.png └── js │ ├── ajax.js │ ├── c.js │ ├── core.js │ ├── jquery-1.11.3.min.js │ └── m.js └── templates ├── customtask.html ├── index.html ├── quickbuild.html ├── sqlshow.html ├── success.html ├── taskdata.html └── tasklist.html /.gitognore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | *.db 3 | -------------------------------------------------------------------------------- /Autosqli.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #!-*- coding:utf-8 -*- 3 | 4 | import json 5 | import time 6 | import threading 7 | import re 8 | import requests 9 | import sys 10 | import os 11 | import sqlite3 12 | import string 13 | import random 14 | import datetime 15 | from urlparse import urlparse 16 | from bs4 import BeautifulSoup 17 | from flask import Flask,render_template,request,session 18 | 19 | SERVER_List=["http://127.0.0.1:8775"] 20 | HEADER={'Content-Type': 'application/json'} #post to sqlmapapi,we should declare http header 21 | taskid_thread_Dict={} #this dictionary will store all task's thread id,it will be use at Delete_Handle 22 | app=Flask(__name__) 23 | lock = threading.Lock() 24 | #---------------------SQLITE initial start------------------------ 25 | app.config.update(dict( 26 | DATABASE=os.path.join(app.root_path+'/DATABASE', 'Autosqli.db'), 27 | DEBUG=True, 28 | SECRET_KEY='546sdafwerxcvSERds549fwe8rdxfsaf98we1r2', 29 | USERNAME='leehdautosqli', 30 | PASSWORD='lifeisshort' 31 | )) 32 | app.config.from_envvar('AUTOSQLI_SETTINGS', silent=True) 33 | 34 | #---------------------this secret key is for session 35 | app.secret_key = "34$#4564dsfaWEERds/*-()^=sadfWE89SA" 36 | #--------------------------------------------------- 37 | def connect_Db():#connect database 38 | rv=sqlite3.connect(app.config['DATABASE']) 39 | rv.row_factory=sqlite3.Row 40 | return rv 41 | def get_Db(): #equals to connect_Db() 42 | sqlite_db=connect_Db() 43 | return sqlite_db 44 | def init_Db(): #initial database ,this function will rebuild database--Autosqli.db 45 | with app.app_context(): 46 | db=get_Db() 47 | with app.open_resource('DATABASE/schema.sql',mode='r') as f: 48 | db.cursor().executescript(f.read()) 49 | db.commit() 50 | def query_db(query, args=(), one=False): #execute a sql select command parameter 'one' means return one record or all 51 | db=get_Db() 52 | cur = db.execute(query, args) 53 | rv = [dict((cur.description[idx][0], value) 54 | for idx, value in enumerate(row)) for row in cur.fetchall()] 55 | return (rv[0] if rv else None) if one else rv 56 | @app.teardown_appcontext 57 | def close_Db(error):#close database 58 | db=get_Db() 59 | db.close() 60 | 61 | #---------------------SQLITE initial end------------------------ 62 | 63 | #---------------------Random String ---------------------------- 64 | def get_RandomStr(length=1): 65 | source="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890" 66 | if length>0: 67 | return string.join(random.sample(source,length), sep='') 68 | else: 69 | return '0' 70 | #---------------------Random String end------------------------- 71 | 72 | #---------------------Set SESSION for user---------------------- 73 | def set_Session(): 74 | if 'username' not in session: 75 | session['username'] = datetime.datetime.now().strftime("%Y-%m-%d") 76 | #---------------------Set SESSION end -------------------------- 77 | 78 | #-------------Functions to write data to database--------------- 79 | def write_Log(taskid,message={}): 80 | log = query_db('select log from Autosqli where taskid = ?', 81 | [taskid], one=True)['log'] 82 | log=eval(log) #convert str to a list 83 | log.append(message)#append message at end of log list 84 | db=get_Db()#write log to database 85 | db.execute('update Autosqli set log = ? where taskid = ?', 86 | [str(log),taskid]) 87 | db.commit() 88 | return True 89 | def write_Data(taskid,data=""): 90 | db=get_Db() 91 | db.execute('update Autosqli set data = ? where taskid = ?', 92 | [data,taskid]) 93 | db.commit() 94 | return True 95 | def write_Status(taskid,status=""): 96 | db=get_Db() 97 | db.execute('update Autosqli set status = ? where taskid = ?', 98 | [status,taskid]) 99 | db.commit() 100 | return True 101 | def write_Url(taskid,url=""): 102 | db=get_Db() 103 | db.execute('update Autosqli set url = ? where taskid = ?', 104 | [url,taskid]) 105 | db.commit() 106 | return True 107 | def write_UrlParameters(taskid,url_paramters_list=[]): 108 | db=get_Db() 109 | db.execute('update Autosqli set url_parameters = ? where taskid = ?', 110 | [str(url_paramters_list),taskid]) 111 | db.commit() 112 | return True 113 | #-------------Functions to write data to database end------------ 114 | 115 | #-------------Functions to get parameters in URL----------------- 116 | def get_UrlParamters(URL): 117 | m=re.match('(http://)|(https://)',URL) 118 | if m is None: 119 | URL="http://"+URL 120 | option_list=[] 121 | m=re.match('(.+)\?',URL) 122 | if m is None: 123 | option_list.append(URL) 124 | return option_list 125 | temp_list=re.findall('\?(\w+)=',URL) 126 | for i in temp_list: 127 | if i!="": 128 | option_list.append(i) 129 | temp_list=re.findall('\&(\w+)=',URL) 130 | for i in temp_list: 131 | if i!="": 132 | option_list.append(i) 133 | for i in range(len(option_list)): 134 | option_list[i]=option_list[i].encode('utf-8') 135 | return option_list 136 | #-------------Functions to get parameters in URL end------------- 137 | def get_Server(): 138 | tasklist = query_db('select * from Autosqli where status = ?',["running"]) 139 | server_runningNum_dict={} 140 | for server in SERVER_List: 141 | server_runningNum_dict[server]=0 142 | if len(tasklist)!=0: 143 | for task in tasklist: 144 | server_runningNum_dict[task['server']]+=1 145 | return sorted(server_runningNum_dict.iteritems(),key=lambda t:t[1],reverse=False)[0][0] 146 | else: 147 | return SERVER_List[0] 148 | def new_Taskid(): 149 | '''get a new taskid''' 150 | server=get_Server() 151 | url=server+"/task/new" 152 | responseData=json.loads(requests.get(url,None).text) 153 | if(responseData['success']==True): 154 | taskid=responseData['taskid'] 155 | log=str([{time.strftime("[*%H:%M:%S]"):"Built a new task successfully"}]) 156 | db=get_Db() #insert a new record into database 157 | db.execute('insert into Autosqli (taskid, log,user,server) values (?, ?, ? ,?)', 158 | [taskid,log,session['username'],server]) 159 | db.commit() 160 | write_Status(taskid, status="not running") 161 | return taskid 162 | else: 163 | return False 164 | 165 | def set_Options(taskid,options={}): 166 | if options is None: 167 | return False 168 | server=query_db('select server from Autosqli where taskid = ?',[taskid],one=True)['server'] 169 | url=server+"/option/"+taskid+"/set" 170 | for k in options: 171 | if options[k]=="False" or options[k]=="": 172 | del options[k] 173 | if 'url' in options.keys(): 174 | write_Url(taskid, url=options['url']) 175 | write_UrlParameters(taskid, url_paramters_list=get_UrlParamters(options['url'])) 176 | data=json.dumps(options) 177 | responseData=json.loads(requests.post(url,data=data,headers=HEADER).text) 178 | if(responseData['success']==True): 179 | log={time.strftime("[*%H:%M:%S]"):"Set Options successfully"} 180 | write_Log(taskid,log) 181 | db=get_Db() 182 | db.execute('update Autosqli set options = ? where taskid = ?', 183 | [data,taskid]) 184 | db.commit() 185 | return True 186 | else: 187 | return False 188 | 189 | def Thread_Handle(taskid): 190 | lock.acquire() 191 | server=query_db('select server from Autosqli where taskid = ?',[taskid],one=True)['server'] 192 | url_status=server+"/scan/"+taskid+"/status" 193 | url_log=server+"/scan/"+taskid+"/log" 194 | url_data=server+"/scan/"+taskid+"/data" 195 | db=get_Db() 196 | response_status=json.loads(requests.get(url_status,None).text)['status'] 197 | db.execute('update Autosqli set status = ? where taskid = ?', 198 | [response_status,taskid]) 199 | db.commit() 200 | while response_status!="terminated" and response_status!="deleting": 201 | time.sleep(2) 202 | response_status=json.loads(requests.get(url_status,None).text)['status'] 203 | response_loglist=json.loads(requests.get(url_log,None).text)['log'] 204 | for log in response_loglist: 205 | write_Log(taskid, {"[*"+log['time']+"]":log['message']}) 206 | write_Status(taskid, response_status) 207 | response_data=requests.get(url_data,None).text 208 | if response_data==None: 209 | return False 210 | write_Data(taskid, response_data) 211 | lock.release() 212 | return True 213 | 214 | def start_Scan(taskid): 215 | server=query_db('select server from Autosqli where taskid = ?',[taskid],one=True)['server'] 216 | url=server+"/scan/"+taskid+"/start" 217 | responseData=json.loads(requests.post(url,None,{'Content-Type': 'application/json'}).text) 218 | if(responseData['success']==True): 219 | write_Log(taskid,{time.strftime("[*%H:%M:%S]"):"Started a new scan successfully"}) 220 | write_Status(taskid, status="scaning") 221 | t=threading.Thread(target=Thread_Handle,args=(taskid,)) 222 | taskid_thread_Dict[taskid]=t 223 | t.start() 224 | return True 225 | else: 226 | return False 227 | def stop_Scan(taskid): 228 | server=query_db('select server from Autosqli where taskid = ?',[taskid],one=True)['server'] 229 | url=server+"/scan/"+taskid+"/stop" 230 | responseData=json.loads(requests.get(url,None).text) 231 | if(responseData['success']==True): 232 | write_log(taskid,{time.strftime("[*%H:%M:%S]"):"Task was stopped by user"}) 233 | return True 234 | else: 235 | return False 236 | def Delete_Handle(taskid): 237 | write_Status(taskid, status="deleting") 238 | server=query_db('select server from Autosqli where taskid = ?',[taskid],one=True)['server'] 239 | url=server+"/task/"+taskid+"/delete" 240 | if(taskid in taskid_thread_Dict.keys()): 241 | while(taskid_thread_Dict[taskid].isAlive()): 242 | time.sleep(2) 243 | json.loads(requests.get(url,None).text) 244 | db=get_Db() 245 | db.execute('delete from Autosqli where taskid = ?', 246 | [taskid]) 247 | db.commit() 248 | return True 249 | 250 | def delete_Task(taskid): 251 | t=threading.Thread(target=Delete_Handle,args=(taskid,)) 252 | t.start() 253 | return True 254 | 255 | def save_successresult(options): 256 | rebeat = query_db("select url from SuccessTarget where user = ?", [session['username']]) 257 | if len(rebeat) >0 : 258 | return None 259 | db=get_Db() #insert a new record into database 260 | db.execute('insert into SuccessTarget (url, data,user) values (?, ?, ?)', 261 | [options['url'],options['data'],session['username']]) 262 | db.commit() 263 | 264 | def getsuccessresult(): 265 | tasklist = query_db('select * from SuccessTarget where user = ?',[session['username']]) 266 | if len(tasklist)>0: 267 | for task in tasklist: 268 | for key in task.keys(): 269 | if task[key]=="" or task[key]==None: 270 | task[key]="Empty" 271 | return tasklist 272 | 273 | def get_TaskList(): 274 | if session['username']=="": 275 | return False 276 | tasklist = query_db('select * from Autosqli where user = ?',[session['username']]) 277 | if len(tasklist)>0: 278 | for task in tasklist: 279 | for key in task.keys(): 280 | if task[key]=="" or task[key]==None: 281 | task[key]="Empty" 282 | return tasklist 283 | def get_TaskLog(taskid): 284 | loglist=query_db('select log from Autosqli where taskid = ?',[taskid],one=True)['log'] 285 | loglist=eval(loglist) 286 | return_html='
' 287 | for log in loglist: 288 | time=log.keys()[0] 289 | return_html=return_html+""+time+log[time]+"
" 290 | return return_html 291 | def get_TaskData(taskid): 292 | data=query_db('select data from Autosqli where taskid = ?',[taskid],one=True)['data'] 293 | return data 294 | 295 | def task_Dup(Options={}): 296 | options=Options.copy() 297 | tasklist=query_db('select url_parameters,options from Autosqli where user = ?',[session['username']]) 298 | if len(tasklist)==0: 299 | return 1 300 | urlparamters=get_UrlParamters(options['url']) 301 | del options['url'] 302 | for task in tasklist: 303 | templist_UrlParam=eval(task['url_parameters']) 304 | tempdic_Options=json.loads(task['options']) 305 | if 'url' in tempdic_Options.keys(): 306 | del tempdic_Options['url'] 307 | if sorted(urlparamters)==sorted(templist_UrlParam) and options==tempdic_Options: 308 | return -1 309 | return 1 310 | 311 | #------------------new Feature------------------------------- 312 | def gethref(url): 313 | def sp(urls): 314 | print urls 315 | alist = set() 316 | headers = {"User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:47.0) Gecko/20100101 Firefox/47.0"} 317 | req = requests.get(url, headers=headers) 318 | domain = "{0}://{1}".format(urlparse(url).scheme, urlparse(url).netloc) 319 | soup = BeautifulSoup(req.text, "lxml") 320 | # import ipdb;ipdb.set_trace() 321 | if len(soup.find_all('a')) == 0: 322 | alist.add(urls) 323 | return 324 | for a in soup.find_all('a'): 325 | if a.has_attr('href') == False: 326 | continue 327 | if a['href'].startswith(domain): 328 | alist.add(a['href']) 329 | elif a['href'].startswith('http') == False: 330 | us = "{0}/{1}/{2}".format(domain, urlparse(url).path, a['href']) 331 | alist.add(us) 332 | return alist 333 | tmp1 = tmp2 = sp(url) 334 | if(tmp2!=None): 335 | for u in tmp2: 336 | tmp1 = tmp1 | sp(u) 337 | return tmp1 338 | else: 339 | return set([url]) 340 | 341 | def GetSuccessTarget(): 342 | slist = {} 343 | flag = re.compile(r'payload":\s+"(.*?)"') 344 | tasklist = get_TaskList() 345 | for task in tasklist: 346 | try: 347 | data = flag.search(task['data']).groups()[0] 348 | slist['url'] = task['url'] 349 | slist['data'] = data 350 | save_successresult(slist) 351 | except: 352 | pass 353 | return slist 354 | 355 | 356 | #-------------------A test page---------------------------------- 357 | #@app.route('/sqlshow.html') 358 | #def show_entries(): 359 | #db=get_Db() 360 | #cur = db.execute("select * from Autosqli") 361 | #entry=cur.fetchall() 362 | #tasklist=query_db('select user from Autosqli where taskid = ?',['7abc8e899783367a'],one=True) 363 | #return render_template('sqlshow.html', entries=entry,data=str(request.remote_addr)) 364 | #-------------------A test page end------------------------------ 365 | @app.route('/',methods=['GET']) 366 | def handle_root(): 367 | set_Session() 368 | return render_template("index.html") 369 | 370 | @app.route('/index.html',methods=['GET']) 371 | def handle_index(): 372 | set_Session() 373 | return render_template("index.html") 374 | 375 | @app.route('/quickbuild.html',methods=['GET']) 376 | def handle_quickbuild(): 377 | set_Session() 378 | return render_template("quickbuild.html") 379 | @app.route('/quickbuild.html',methods=['POST']) 380 | def handle_post_quickbuild(): 381 | options={} 382 | if 'url' in request.json and request.json['url']!="": 383 | options['url']=request.json['url'] 384 | m=re.match('(http://)|(https://)',options['url']) #add http:// for targetURL 385 | if m is None: 386 | options['url']="http://"+options['url'] 387 | if task_Dup(options)!= 1: 388 | return "False" 389 | else: 390 | taskid=new_Taskid() 391 | if taskid: 392 | result=set_Options(taskid,options) 393 | return str(result) 394 | else: 395 | return "False" 396 | else: 397 | return "False" 398 | 399 | @app.route('/customtask.html',methods=['GET']) 400 | def handle_customtask(): 401 | set_Session() 402 | return render_template("customtask.html") 403 | 404 | @app.route('/customtask.html',methods=['POST']) 405 | def handle_post_customtask(): 406 | options={} 407 | for k in request.form: 408 | if request.form[k] and request.form[k] != "False" and request.form[k]!= "": 409 | options[k]=request.form[k] 410 | if 'url' not in options.keys(): 411 | return render_template("customtask.html",result="Error:Please input URL.") 412 | m=re.match('(http://)|(https://)',options['url']) #add http:// for targetURL 413 | if m is None: 414 | options['url']="http://"+options['url'] 415 | 416 | urls = gethref(options['url']) 417 | for u in urls: 418 | options['url']=u 419 | if task_Dup(options)==1:#这里去重从逻辑上来更合理,但是没多大意义 420 | taskid=new_Taskid() 421 | if taskid: 422 | result = set_Options(taskid,options) 423 | else: 424 | return render_template("customtask.html",result="Error:Can not establish task.") 425 | return render_template("tasklist.html") 426 | @app.route('/spider',methods=['POST']) 427 | def hander_spider(): 428 | if 'url' in request.json and request.json['url']!="": 429 | url=request.json['url'] 430 | m=re.match('(http://)|(https://)',url) #add http:// for targetURL 431 | if m is None: 432 | url="http://"+url 433 | try: 434 | result=gethref(url) 435 | except Exception, e: 436 | return "False" 437 | if(len(result)!=0): 438 | li_list="" 439 | for u in result: 440 | li_list=li_list+"Now has {0} tasks to running
No task for you
TaskID: '+\ 459 | task['taskid']+\ 460 | '
Status: '+\ 461 | task['status']+'
'+\ 462 | 'TargetURL: '+\ 463 | task['url']+'
'+\ 464 | 'URL Paramters: '+\ 465 | task['url_parameters']+'
'+\ 466 | 'Options: '+\ 467 | task['options']+'
'+\ 468 | 'Server: '+\ 469 | task['server']+'
'+\ 470 | ' '+\ 472 | ''+\ 473 | 'Data'+\ 474 | ' '+\ 476 | ' '+\ 478 | 'Now has {0} tasks to running
No task for you
TaskID: '+\ 507 | task['taskid']+\ 508 | '
Status: '+\ 509 | task['status']+'
'+\ 510 | 'TargetURL: '+\ 511 | task['url']+'
'+\ 512 | 'URL Paramters: '+\ 513 | task['url_parameters']+'
'+\ 514 | 'Options: '+\ 515 | task['options']+'
'+\ 516 | 'Server: '+\ 517 | task['server']+'
'+\ 518 | ' '+\ 520 | ''+\ 521 | 'Data'+\ 522 | ' '+\ 524 | ' '+\ 526 | 'Now has {0} url success crack
URL: '+\ 538 | url['url']+\ 539 | '
payload: '+\ 540 | url['data']+'
"+html+""; 42 | 43 | }catch(e){ 44 | $id("Canvas").innerHTML = ""; 45 | 46 | } 47 | 48 | } 49 | 50 | window._dateObj = new Date(); 51 | 52 | window._regexpObj = new RegExp(); 53 | 54 | function ProcessObject(obj, indent, addComma, isArray, isPropertyContent){ 55 | 56 | var html = ""; 57 | 58 | var comma = (addComma) ? ", " : ""; 59 | 60 | var type = typeof obj; 61 | 62 | var clpsHtml =""; 63 | 64 | if(IsArray(obj)){ 65 | 66 | if(obj.length == 0){ 67 | 68 | html += GetRow(indent, "[ ]"+comma, isPropertyContent); 69 | 70 | }else{ 71 | 72 | clpsHtml = window.IsCollapsible ? "
t |
{{result|safe}}
82 | 140 |爬虫入口URL:
142 | 143 | 144 |Add url here
55 | 56 | 57 |Attention
60 |If you use Quickly Build to start your scan task
61 |there is no options or all options is None.
62 |It means the options like cookies,smart,dbs will not set to your task
63 |If you want to use these options,please choose Custom Task.
64 |{{data|safe}}
15 | {% for entry in entries %} 16 |456545464
24 |