(批量注入)使用SqlmapApi批量扫描

python3 sqlmapapi.py -s -H 0.0.0.0 -p 8775

python3 sqlmapapi.py -s

import requestsimport jsonimport time
ip = "127.0.0.1" # 自己改成自己的IPdef sqlmapapi(url):    headers = {  # 数据包里的数据.        'Content-Type': 'application/json'    }    data = {                                         # 输入扫描的地址.        'url': url    }    task_new_url = 'http://'+ip+':8775/task/new'  # 创建任务的URL地址(在IP地址后面加//task/new).  前面的四个就是获取ID信息.    resp = requests.get(task_new_url)                # 使用get方式请求.    task_id = resp.json()['taskid']                  # 打印json格式下的taskid数据.    #print(resp.content.decode('utf-8'))              #打印utf-8格式    if 'success' in resp.content.decode('utf-8'):                                           #如果success在resp.content.decode('utf-8')里面        print('sqlmapapi 创建任务ID成功!')        scan_task_set_url = 'http://'+ip+':8775/option/' + task_id + '/set'              #添加的是上面创建的新任务ID(/option和/set这二个是固定的.)        scan_task_set = requests.post(scan_task_set_url, data=json.dumps(data), headers=headers)    #使用post方式提交.data=是提交的数据(提交data里面的数据.)        #print(task_set_resp.content.decode('utf-8'))                                       #打印utf-8格式        if 'success' in scan_task_set.content.decode('utf-8'):                              #如果success在task_set_resp.content.decode('utf-8')里面设置任务ID的配置            print('sqlmapapi 设置任务ID的配置成功!')            task_start_url = 'http://'+ip+':8775/scan/' + task_id + '/start'             #添加的是上面创建的新任务ID(/scan和/start是启动对应ID的扫描任务文件.)            task_start_resp = requests.post(task_start_url, data=json.dumps(data),headers=headers)  # 使用post方式提交.data=是提交的数据(提交data里面的数据.)            # print(task_start_resp.content.decode('utf-8'))                                #打印utf-8格式            if 'success' in task_start_resp.content.decode('utf-8'):                        #如果success在task_start_resp.content.decode('utf-8')里面                print('sqlmap 扫描启动成功!')                while 1:                    task_status_url = 'http://'+ip+':8775/scan/' + task_id + '/status'   #添加的是上面创建的新任务ID(/scan和/status是启动对应ID的扫描任务文件.)                    task_status_resp = requests.get(task_status_url)                        #使用post方式提交                    #print(task_status_resp.content.decode('utf-8'))                        #打印utf-8格式                    if 'running' in task_status_resp.content.decode('utf-8'):               #还在扫描中                        print(url + '还在扫描中!')                        pass                    else:                                                                   #否则扫描成功!                        print('sqlmapapi 扫描结束!')                        task_data_url = 'http://'+ip+':8775/scan/' + task_id + '/data'   #打印data结果.                        scan_data = requests.get(task_data_url).content.decode('utf-8')                        #使用post方式提交                        with open(r'result.txt', 'a+', encoding='utf-8') as f:                            data=json.loads(scan_data)                            if data['success'] == True:                                if len(data['data']) > 0:                                    f.write(url + "   注入存在！！！n")                                    f.write("param:n")                                    query = data['data'][0]                                    f.write(' - ' + query['value']['query']+'n')                                    f.write("payloads:n")                                    value = data['data']                                    value_num = value[1]                                    value_data = value_num['value']                                    value_data_0 = value_data[0]                                    value_data_0_data = value_data_0['data']                                    for key in value_data_0_data.keys():                                        payload = value_data_0_data[key]                                        f.write(' - ' + payload['payload'] + 'n')                                        f.write('n')                            f.close()                        scan_deltask_url = 'http://'+ip+':8775/task/' + task_id + '/delete'                        scan_deltask=requests.get(scan_deltask_url)                        if 'success' in scan_deltask.content.decode('utf-8'):                            print('删除 task id 成功')                        break   #结束(跳出)                    time.sleep(3)           #延迟3秒.  if __name__ == '__main__':    for url in open('url.txt'):        url=url.replace('n','')        if url.find('?')!=-1:            sqlmapapi(url)