sqlmapproject / sqlmap

Automatic SQL injection and database takeover tool
http://sqlmap.org
Other
30.88k stars 5.56k forks source link

Add sqlmapapi api to get admin token with user-pass. #5690

Closed G3G4X5X6 closed 1 month ago

G3G4X5X6 commented 1 month ago

Question

I need to access the admin api of sqlmapapi remotely and it requires admin_token. But the only way to get the token is to copy it from standard output, which is inconvenient.

Requirements

get admin_token from sqlmapapi with user-pass.

stamparm commented 1 month ago

so, how this goes.

i'll now say "you are deliberately incorporating a security vuln", and you'll say "naah, i didn't know"

with your pull request anybody can access the admin's token. main point of "hiding" admin token in passwordless run was to prevent this kind of scenarios

stamparm commented 1 month ago

blocked your future pull requests as i don't like this kind of "attempts". better safe than sorry