Use sqlmap as a library

[jetz]

Hi @stamparm:

I want to embed sqlmap into my project as a library (not subporcess call), but found it's difficult, so I have to write a wrapper to call sqlmap.main() and retrive the result from session.sqlite, just as the following snippet (should be placed in sqlmap dir, it raises exception if use pip-installed sqlmap). Is there a simpler way to do it (eg. just call an entrypoint callable and get the json result)?

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
import pprint
import sqlmap
from lib.core.enums import HASHDB_KEYS
from lib.core.common import hashDBRetrieve


def patch_exit(x):
    pass
os._exit = patch_exit


def p(data):
    pprint.pprint(r)

if __name__ == "__main__":
    sqlmap.main()
    try:
        r = hashDBRetrieve(HASHDB_KEYS.KB_INJECTIONS, True)
        p(r)
    except Exception as e:
        print(e)

[stamparm]

But sqlmap doesn't have a support for the thing you wish to do. How you imagined propagation of options/switches to sqlmap in your scenario? I'll repeat. sqlmap was never being run nor planned to be run as a library.

[jetz]

Of course, sqlmap will still run as a standalone. I just hope that sqlmap can expose some interfaces to call with target and configs, then will get the result directly, just as the sqlmapapi json response, but not a server.

[stamparm]

There are lots of potential problems. For start, original idea of the sqlmapapi was to provide the programmable interface toward other programs to prevent messing around with "library calls" and everything. For example, in case of an library call there would be no way to check the status of the program run - this would most probably raise other issues simply for implementing this kind of "interface". Also, password hash cracking uses multiprocessing by default and this would cause lots and lots of problems if called from such library interface. Anyway, I really see lots of problems here versus potential benefits, hence I'll need to close this down