Skip to content

Commit 970e29f

Browse files
atiillaatiilla
committed
Added allow_private_networks setting to SecurityConfig for controlling access to local/private IPs.
1 parent 00b9544 commit 970e29f

10 files changed

Lines changed: 734 additions & 549 deletions

‎README.md‎

Lines changed: 22 additions & 537 deletions
Large diffs are not rendered by default.

‎config.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
ai_providers:
2+
anthropic:
3+
api_key_env: ANTHROPIC_API_KEY
4+
enabled: false
5+
max_tokens: 4096
6+
model: claude-3-haiku-20240307
7+
name: anthropic
8+
priority: 3
9+
rate_limit: 1.0
10+
timeout: 30
11+
groq:
12+
api_key_env: GROQ_API_KEY
13+
enabled: false
14+
max_tokens: 4096
15+
model: qwen/qwen3-32b
16+
name: groq
17+
priority: 1
18+
rate_limit: 0.5
19+
timeout: 30
20+
local:
21+
api_key_env: ''
22+
enabled: false
23+
max_tokens: 512
24+
model: microsoft/DialoGPT-medium
25+
name: local
26+
priority: 5
27+
rate_limit: 0.1
28+
timeout: 60
29+
ollama:
30+
api_key_env: ''
31+
enabled: false
32+
max_tokens: 4096
33+
model: llama3.2
34+
name: ollama
35+
priority: 4
36+
rate_limit: 0.5
37+
timeout: 60
38+
openai:
39+
api_key_env: OPENAI_API_KEY
40+
enabled: false
41+
max_tokens: 4096
42+
model: gpt-4o-mini
43+
name: openai
44+
priority: 2
45+
rate_limit: 1.0
46+
timeout: 30
47+
config_version: '1.0'
48+
custom_settings: {}
49+
debug: false
50+
log_level: INFO
51+
logging:
52+
audit_log_file: sqlmap_ai_audit.log
53+
backup_count: 5
54+
enable_file_logging: true
55+
log_directory: logs
56+
main_log_file: sqlmap_ai.log
57+
max_log_size_mb: 50
58+
reporting:
59+
auto_save: true
60+
compress_reports: false
61+
default_format: html
62+
enable_charts: true
63+
enable_json: true
64+
enable_pdf: true
65+
include_raw_data: false
66+
output_directory: reports
67+
security:
68+
allow_private_networks: true
69+
allowed_domains: []
70+
blocked_domains: []
71+
enable_audit_logging: true
72+
enable_rate_limiting: true
73+
max_concurrent_scans: 3
74+
max_requests_per_hour: 500
75+
max_requests_per_minute: 30
76+
require_confirmation: true
77+
safe_mode: true
78+
sqlmap:
79+
custom_tamper_scripts: []
80+
default_level: 1
81+
default_risk: 1
82+
default_threads: 5
83+
default_timeout: 120
84+
enable_tamper_scripts: true
85+
max_level: 3
86+
max_risk: 2
87+
max_threads: 20
88+
max_timeout: 600
89+
ui:
90+
confirm_dangerous_operations: true
91+
enable_colors: true
92+
interactive_mode: false
93+
progress_indicators: true
94+
show_banner: true
95+
verbose_output: false
96+
version: 2.0.0

‎docs/CHANGELOG.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Changelog
2+
3+
## v2.0.6
4+
- [x] **Private Network Scanning** - Local/private IP targets now allowed by default (configurable via `allow_private_networks` in `config.yaml`)
5+
- [x] **Configurable Network Policy** - New `allow_private_networks` security setting for controlling local network access
6+
- [x] **Improved Test Coverage** - Added dedicated tests for private network validation behavior
7+
8+
## v2.0.5
9+
- [x] **Parameter Selection** - Target specific parameters with `-p id,username`
10+
- [x] **Enhanced Reports** - Detailed HTML reports with tables, columns, and payloads
11+
- [x] **Global SQLMap** - Uses your system's SQLMap installation
12+
- [x] **Bug Fixes** - Improved database tracking and report generation

‎docs/CONFIGURATION.md‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# Configuration
2+
3+
## .env File
4+
5+
Created automatically by `sqlmap-ai --install-check`:
6+
7+
```bash
8+
# AI Provider API Keys
9+
GROQ_API_KEY=your_groq_api_key_here
10+
OPENAI_API_KEY=your_openai_api_key_here
11+
ANTHROPIC_API_KEY=your_anthropic_api_key_here
12+
13+
# Ollama Settings (if using local AI)
14+
ENABLE_OLLAMA=false
15+
OLLAMA_BASE_URL=http://localhost:11434
16+
OLLAMA_MODEL=llama3.2
17+
18+
# Security Settings
19+
MAX_REQUESTS_PER_MINUTE=60
20+
SAFE_MODE=true
21+
AUDIT_LOGGING=true
22+
```
23+
24+
## config.yaml
25+
26+
Created automatically by `sqlmap-ai --config-wizard`:
27+
28+
```yaml
29+
version: "2.0"
30+
security:
31+
safe_mode: true
32+
max_requests_per_minute: 60
33+
audit_logging: true
34+
allow_private_networks: true # Set to false to block local/private IP targets
35+
36+
sqlmap:
37+
default_timeout: 120
38+
default_risk: 1
39+
default_level: 1
40+
default_threads: 5
41+
42+
ui:
43+
show_banner: true
44+
interactive_mode: false
45+
```
46+
47+
## Command-Line Options
48+
49+
### Target Specification
50+
```bash
51+
-u, --url URL Target URL (e.g., "http://example.com/page?id=1")
52+
-r, --request FILE Load HTTP request from file (Burp/ZAP/Browser)
53+
```
54+
55+
### Parameter Testing
56+
```bash
57+
-p, --param PARAMS Test specific parameter(s) (comma-separated)
58+
Examples: -p id | -p id,username,token
59+
```
60+
61+
### Scanning Options
62+
```bash
63+
--adaptive Use adaptive step-by-step testing
64+
--aggressive Aggressive testing (risk=3, level=5)
65+
--stealth Stealth mode (slower, more evasive)
66+
--timeout SECONDS Scan timeout in seconds (default: 120)
67+
--threads NUM Number of threads 1-20 (default: 5)
68+
--risk LEVEL Risk level 1-3 (default: 1)
69+
--level LEVEL Test level 1-5 (default: 1)
70+
```
71+
72+
### AI Configuration
73+
```bash
74+
--ai-provider PROVIDER AI provider: groq|openai|anthropic|ollama|auto
75+
--disable-ai Disable AI analysis
76+
--ollama-model MODEL Specific Ollama model to use
77+
```
78+
79+
### WAF Evasion
80+
```bash
81+
--tamper SCRIPTS Tamper scripts (comma-separated)
82+
--auto-tamper Auto-select tamper scripts based on WAF
83+
--random-agent Use random User-Agent
84+
```
85+
86+
### Output Options
87+
```bash
88+
--output-dir DIR Output directory for reports (default: reports)
89+
--output-format FORMAT Output format: html|json|text
90+
--save-json Save results as JSON
91+
```
92+
93+
### Configuration Commands
94+
```bash
95+
--config-wizard Run interactive configuration wizard
96+
--check-providers Check AI provider availability
97+
--list-ollama-models List available Ollama models
98+
--install-check Check installation and create config files
99+
--validate-config Validate current configuration
100+
```

‎docs/INSTALLATION.md‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# Installation
2+
3+
## Prerequisites
4+
5+
- Python 3.8+
6+
- SQLMap (must be installed globally on your system)
7+
- Internet connection (for cloud AI providers)
8+
- 2GB+ RAM (for Ollama local models)
9+
10+
## Step 1: Install SQLMap
11+
12+
First, install SQLMap globally on your system:
13+
14+
```bash
15+
# Kali/Debian/Ubuntu
16+
sudo apt install sqlmap
17+
18+
# macOS
19+
brew install sqlmap
20+
21+
# Or from source
22+
git clone https://github.com/sqlmapproject/sqlmap.git
23+
cd sqlmap
24+
sudo python setup.py install
25+
26+
# Verify installation
27+
sqlmap --version
28+
```
29+
30+
## Step 2: Install SQLMap AI
31+
32+
```bash
33+
# Clone the repository
34+
git clone https://github.com/atiilla/sqlmap-ai.git
35+
cd sqlmap-ai
36+
37+
# Install the package
38+
pip install -e .
39+
40+
# Or install from PyPI
41+
pip install sqlmap-ai
42+
43+
# Run installation check (creates config files)
44+
sqlmap-ai --install-check
45+
```
46+
47+
## Step 3: Configure AI Providers
48+
49+
Choose one or more AI providers to use:
50+
51+
### Option A: Groq (Recommended - Fastest)
52+
1. Get a free API key from [https://console.groq.com](https://console.groq.com)
53+
2. Add to your `.env` file:
54+
```bash
55+
GROQ_API_KEY=your_groq_api_key_here
56+
```
57+
58+
### Option B: OpenAI
59+
1. Get an API key from [https://platform.openai.com](https://platform.openai.com)
60+
2. Add to your `.env` file:
61+
```bash
62+
OPENAI_API_KEY=your_openai_api_key_here
63+
```
64+
65+
### Option C: Anthropic (Claude)
66+
1. Get an API key from [https://console.anthropic.com](https://console.anthropic.com)
67+
2. Add to your `.env` file:
68+
```bash
69+
ANTHROPIC_API_KEY=your_anthropic_api_key_here
70+
```
71+
72+
### Option D: Ollama (Local AI - Privacy Focused)
73+
1. Install Ollama: [https://ollama.ai/download](https://ollama.ai/download)
74+
2. Start Ollama service:
75+
```bash
76+
ollama serve
77+
```
78+
3. Download a model:
79+
```bash
80+
ollama pull llama3.2
81+
```
82+
4. Enable in your `.env` file:
83+
```bash
84+
ENABLE_OLLAMA=true
85+
OLLAMA_MODEL=llama3.2
86+
```
87+
88+
### Ollama Model Selection
89+
90+
If using Ollama, you can select different models:
91+
92+
```bash
93+
# List available models
94+
sqlmap-ai --list-ollama-models
95+
96+
# Interactive model selection
97+
sqlmap-ai --config-wizard
98+
```
99+
100+
Popular models:
101+
- **llama3.2** - Good general performance
102+
- **codellama** - Specialized for code analysis
103+
- **mistral** - Fast and efficient
104+
- **qwen2.5** - Good reasoning capabilities
105+
106+
## Step 4: Run Configuration Wizard
107+
108+
```bash
109+
# Interactive setup
110+
sqlmap-ai --config-wizard
111+
```
112+
113+
This will:
114+
- Check your AI provider setup
115+
- Let you select Ollama models (if using Ollama)
116+
- Configure security settings
117+
- Set up SQLMap options
118+
119+
## Step 5: Test Your Setup
120+
121+
```bash
122+
# Check if everything is working
123+
sqlmap-ai --check-providers
124+
125+
# List available Ollama models (if using Ollama)
126+
sqlmap-ai --list-ollama-models
127+
```
128+
129+
## AI Providers Comparison
130+
131+
| Provider | Setup | Speed | Privacy | Cost |
132+
|----------|-------|-------|---------|------|
133+
| **Groq** | API Key | Fastest | Cloud | Free tier available |
134+
| **OpenAI** | API Key | Fast | Cloud | Pay per use |
135+
| **Anthropic** | API Key | Fast | Cloud | Pay per use |
136+
| **Ollama** | Local install | Fast | Local | Free |

‎docs/TROUBLESHOOTING.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Troubleshooting
2+
3+
## Common Issues
4+
5+
**1. "No AI providers available"**
6+
- Check your `.env` file has correct API keys
7+
- Run `sqlmap-ai --check-providers` to verify
8+
9+
**2. "Ollama not detected"**
10+
- Make sure Ollama is running: `ollama serve`
11+
- Check if models are installed: `ollama list`
12+
- Verify `.env` has `ENABLE_OLLAMA=true`
13+
14+
**3. "SQLMap not found"**
15+
- Install SQLMap globally using one of these methods:
16+
- **Kali/Debian/Ubuntu:** `sudo apt install sqlmap`
17+
- **macOS:** `brew install sqlmap`
18+
- **From source:** `git clone https://github.com/sqlmapproject/sqlmap.git && cd sqlmap && sudo python setup.py install`
19+
- Verify installation: `sqlmap --version`
20+
21+
**4. "Configuration issues"**
22+
- Run `sqlmap-ai --config-wizard` to fix setup
23+
- Check `sqlmap-ai --validate-config` for issues
24+
25+
**5. "Request file not working"**
26+
- Ensure request file has proper HTTP format
27+
- Check that Host header is present
28+
- Verify request file path is correct
29+
- Try with `--simple` mode first: `sqlmap-ai --simple -r request.txt`
30+
31+
**6. "URL validation failed"**
32+
- When using request files, the URL is automatically extracted
33+
- Ensure request file contains valid HTTP request
34+
- Check that the Host header matches the target domain
35+
36+
## Getting Help
37+
38+
```bash
39+
# Show all available commands
40+
sqlmap-ai --help
41+
42+
# Show enhanced mode help
43+
sqlmap-ai --enhanced --help
44+
45+
# Show simple mode help
46+
sqlmap-ai --simple --help
47+
```

0 commit comments

Comments
 (0)