SQLiX构建笔记

最新推荐文章于 2021-02-04 02:05:06 发布

PolluxAvenger

最新推荐文章于 2021-02-04 02:05:06 发布

阅读量1.4k

点赞数

分类专栏：翻译文章 Linux Hack学习文章标签： perl sqlix 脚本源码虚拟机

Linux 同时被 3 个专栏收录

48 篇文章 1 订阅

订阅专栏

Hack学习

46 篇文章 4 订阅

订阅专栏

翻译文章

10 篇文章 0 订阅

订阅专栏

Making OWASP SQLiX module

Contents [hide]

· 1 Get the source for OWASP SQLiX

· 获取OWASP SQLiX的源码

· 2 Create the needed directories in fakeroot

· 创建fakeroot需要的目录

· 3 Create and put the module's files into the fakeroot directory

· 创建并转移模块文件到fakeroot目录

· 4 Generate the .lzm module

· 生成.lzm模块

· 5 Add the modules to the ISO build directory

· 添加这些模块到ISO 构建目录

· 6 Test the new module

· 测试新的模块

· 7 Clean up and archive

· 清理和归档

Get the source for OWASP SQLiX

获取OWASP SQLiX的源码

Go to the OWASP SQLiX website and navigate to the section. In the downloads section, you'll see two links to download the source.Only one of those worked for me - the one here. Grab the latest version which is SQLiX_v1.0.tar.tar atthe time of this writing. BTW, the file extensions are wrong, it should be atar.gz file not a tar.tar.

前往OWASP SQLiX网站，并且找到这个页面。在下载的页面中，你可以看到两个下载的链接地址。对我来说只有一个可以下载到（注：我两个都没有任何响应，我是在google中搜这个压缩包的名字，找到了一个服务器上的备份，不知道是不是墙的原因。）截止写稿时SQLiX的最新版本是V1.0。顺便说一句，这个文件的扩展名是错误的，应该是.tar.gz而不是.tar.tar。（注：我在下载的时候并没有看到这个问题，下载后就是.tar.gz，不知道是不是官方改正了还是说那个服务器的上传者改正过。）

Go ahead and extract the download into the working/temp directory:

把下载的文件解压到/temp目录下：

$ cp/home/mtesauro/owasp-live-cd/tools-in-SoC-release/SQLiX_v1.0.tar.tar temp/

$ $ filetemp/SQLiX_v1.0.tar.tar

temp/SQLiX_v1.0.tar.tar: gzip compressed data, from Unix,last modified: Thu Aug 17 08:06:20 2006

$ mvtemp/SQLiX_v1.0.tar.tar temp/SQLiX_v1.0.tar.gz

$ cd temp/

$ tar -xjvfSQLiX_v1.0.tar.gz

$ cd ../

Create the needed directories in fakeroot

创建fakefoot需要的目录

Eventually, we'll use dir2lzm to make the module, so lets get thedirectories created that we need:

最后，我们将要使用dir2lzm来构建这个模块，现在让我们先创建我们需要的目录吧！

$ mkdir -p./fakeroot/opt/owasp/

$ mkdir -p./fakeroot/usr/bin

$ mkdir -p./fakeroot/usr/share/aplications

$ mkdir -p./fakeroot/usr/share/pixmaps

Create and put the module's files into the fakerootdirectory

创建并转移模块文件到fakeroot目录

Since we are getting a interpreted source, lets get the Perl source whereit needs to go.

因为我们要“解释”这个源代码（注：我觉得Perl是解释型语言，所以这样翻译了。），所以我们要提供Perl源码安装的位置。

$ mvtemp/SQLiX_v1.0 fakeroot/opt/owasp/

$ mvfakeroot/opt/owasp/SQLiX_v1.0/ fakeroot/opt/owasp/sqlix

Next, well need a script to start SQLiX in fakeroot/usr/bin. This one isvery easy:

接下来，我们需要在fakeroot/usr/bin目录下写一个脚本来启动SQLiX，这是非常简单的：

$ vifakeroot/usr/bin/sqlix

[create script]

$ catfakeroot/usr/bin/sqlix

#!/bin/sh

cd /opt/owasp/sqlix/

perl SQLiX.pl "$@"

Because SQLiX is a command line tool, we're going to create a startupscript to be used by the menu item below.

因为SQLiX是一个命令行工具，我们将要通过下面的代码来创建一个启动脚本。

$ vifakeroot/usr/bin/startup-sqlix

[create script]

$ catfakeroot/usr/bin/startup-sqlix

#/bin/sh

echo " "

echo " OWASP SQLiX - SQL Injection Scanner"

echo " (part of the OWASP Live CD 2008)"

echo " "

echo "======================================================"

echo " -- SQLiX --"

echo"======================================================"

echo " "

echo " **Type 'sqlix --help' for command-line options **"

echo " "

echo "** Maximize the window to aid reading the helpoutput **"

echo " "

Creating SQLiX's menu file is a bit more complicated since it opens in aterminal. Use a text editor and create the file sqlix.desktop

创建SQLiX的菜单文件是有些复杂的，因为它需要在终端中操作。使用一个文本编辑器来创建一个文件sqlix.desktop

$ vifakeroot/usr/share/applications/sqlix.desktop

[create thefile]

$ catfakeroot/usr/share/applications/sqlix.desktop

[Desktop Entry]

Categories=Application;Network;

Comment=

Encoding=UTF-8

Exec[$e]=startup-sqlix; bash

GenericName=SQLiX

Icon=/usr/share/pixmaps/sqlix-icon.png

MimeType=text/html

Name=SQL Injection Scanner

Path[$e]=

StartupNotify=false

Terminal=1

TerminalOptions=-T "SQLiX - SQL InjectionScanner"

Type=Application

X-KDE-StartupNotify=true

X-KDE-SubstituteUID=false

X-KDE-Username=

For the icon, there were no images in the source download. Also, sincethis is a text based application, there's nothing to screen capture. Idefaulted to an OWASP icon I have since its an OWASP tool. I then moved thatinto fakeroot.

至于图标，下载的源码里并没有提供图标。此外，因为这是一个基于文本的应用，所以并没有屏幕截图。因为这是一个OWASP工具，所以我用了一个OWASP的图标做默认图标。然后把它移动到fakeroot目录。

$ cptemp/owasp-icon.png fakeroot/usr/share/pixmaps/sqlix-icon.png

SQLiX requires Perl. Fortunately for me, Perl is already part of SLAX.Unfortunately for me, there are few to no Perl modules on the disk - certainlynot the ones needed for SQLiX. Also unfortunately, I didn't find this out untilafter I installed the first, non-working version of this module. I had to addthose Perl modules, here's how I did it:

SQLiX是需要Perl的。幸运的是，Perl早就是SLAX系统的一部分。不幸的是，这里并没有包含所需要的Perl模块。更加不幸的是，我在第一次安装完之后才知道，缺少这些工作的模块。因为没有这些模块，我必须添加这些Perl模块，接下来就是我是怎么做的。

NOTE: The testing below was done in a Live CD environment after Iinstalled the first version of this module.

注意：下面的测试都是在我安装这个模块的第一个版本的Live CD环境下通过的。

# sqlix

Can't locateWWW/CheckSite/Spider.pm in @INC (@INC contains: ...[bunch of junk removed]

OK. I'm missing some Perl modules. Time for the CPAN dance:

好了，我缺少一些Perl模块，现在是CPAN出场的时间了！

# find / >/root/pre-cpan

# perl -MCPAN -eshell

[snip]

cpan> install WWW::CheckSite::Spider

[snip]

Writing Makefile for WWW::CheckSite

---- Unsatisfied dependencies detected during [A/AB/ABELTJE/WWW-CheckSite-0.018.tar.gz]-----

WWW::Mechanize

HTML::Template

WWW::RobotRules

LWP

[snip]

Writing Makefile for WWW::Mechanize

---- Unsatisfied dependencies detected during[P/PE/PETDANCE/WWW-Mechanize-1.34.tar.gz] -----

HTML::Form

HTML::HeadParser

HTTP::Status

HTML::TokeParser

LWP::UserAgent

HTML::Parser

HTTP::Daemon

HTTP::Request

LWP

[snip]

Writing Makefile for LWP

---- Unsatisfied dependencies detected during [G/GA/GAAS/libwww-perl-5.814.tar.gz]-----

Compress::Zlib

HTML::Tagset

HTML::Parser

[snip]

Writing Makefile for Compress::Zlib

---- Unsatisfied dependencies detected during[P/PM/PMQS/Compress-Zlib-2.012.tar.gz] -----

IO::Uncompress::Gunzip

IO::Compress::Gzip

Compress::Raw::Zlib

IO::Uncompress::Base

IO::Compress::Gzip::Constants

IO::Compress::Base

IO::Compress::Base::Common

[snip]

Writing Makefile for IO::Compress::Zlib

---- Unsatisfied dependencies detected during[P/PM/PMQS/IO-Compress-Zlib-2.012.tar.gz] -----

IO::Uncompress::Base

IO::Compress::Base

Compress::Raw::Zlib

[snip]

# sqlix

Can't locate HTML/TreeBuilder.pm in @INC (@INC contains:...[bunch of junk removed]

# perl -MCPAN -eshell

[snip]

cpan> install HTML::TreeBuilder

[snip]

# sqlix

Can't locate Tie/CharArray.pm in @INC (@INC contains:...[bunch of junk removed]

[snip]

# perl -MCPAN -e shell

[snip]

cpan> install Tie::CharArray

[snip]

# sqlix

Can't locate Algorithm/Diff.pm in @INC (@INC contains:...[bunch of junk removed]

[snip]

# perl -MCPAN -e shell

[snip]

cpan> install Algorithm::Diff

[snip]

# sqlix

======================================================

-- SQLiX --

======================================================

Error: you need to specify a target.

Success (finally). Time to figure out what I installed and put it into theSQLiX module:

最终成功了，是时候找出我们安装了什么并且把它引入SQLiX的模块中。

# find / >post-cpan

# diff pre-cpanpost-cpan | grep changes > changes-cpan

# cp changes-cpanscript-to-pull-cpan

# viscript-to-pull-cpan

[edit this fileand change it into a shell script to copy the installed CPAN stuff into adirectory]

# headscript-to-pull-cpan

#!/bin/sh

mkdir -p /root/fakeroot/usr/bin

cp -a /usr/bin/checksite /root/fakeroot/usr/bin

cp -a /usr/bin/mech-dump /root/fakeroot/usr/bin

cp -a /usr/bin/lwp-mirror /root/fakeroot/usr/bin

cp -a /usr/bin/lwp-download /root/fakeroot/usr/bin

cp -a /usr/bin/lwp-rget /root/fakeroot/usr/bin

cp -a /usr/bin/lwp-request /root/fakeroot/usr/bin

mkdir -p /root/fakeroot/usr/lib/perl5/site_perl/5.8.8

# chmod u+xscript-to-pull-cpan

Before running this script, lets turn the not-quite-working sqlix-1.0.lzmback into a directory structure:

在运行脚本之前，让我们把不能正常工作的SQLiX转移到正确的目录结构。

# mkdir/root/fakeroot

# lzm2dirsqlix-1.0.lzm fakeroot/

[snip]

#./script-to-pull-cpan

# dir2lzmfakeroot/ sqlix-1.0.lzm

Note: Since the above CPAN dance was in the Live CD after Ihad installed the first version of the module you can skip some of the stepsbelow on your second go round. Just don't forget to move the new module off theLive CD via USB drive, scp, etc.

注意：因为CPAN的安装是我在安装第一个版本失败之后的执行步骤，你可以跳过这些步骤，直接进行下一步。不要忘了移除Live CD中的USB驱动器。

Everything is in place to create the modules, a quick final check:

创建模块的全部准备都OK了，最后再快速检查一下：

$ find fakeroot

fakeroot/

fakeroot/opt

fakeroot/opt/owasp

fakeroot/opt/owasp/sqlix

fakeroot/opt/owasp/sqlix/SQLiX.pl

...

Generate the .lzm module

创建.lzm模块

This is the easy part.

这是很简单的一步：

$ ./dir2lzm./fakeroot sqlix-1.0.lzm

Add the modules to the ISO build directory

添加模块到ISO构建目录

Also cake

（这是什么，我真的不知道这是什么意思）

$ cp -isqlix-1.0.lzm ../contents/slax/base/

$ chmod 775../contents/slax/base/sqlix-1.0.lzm

Testthe new module

测试这个新模块

I like scp'ing the new modules into a running Live CD and using the ModuleManager to Add modulesto a running system. I typicallyhave the Live CD running in a VM while I create modules so its already up andready.

我喜欢scp一个新模块到正在运行的Live CD中，并且使用模块管理器添加这个模块到一个正在运行的系统中。我通常在我早就准备好的虚拟机中创建。

You can also gen a new ISO and run it in a VM of your choice.

你也可以创建一个新的ISO并且在你选择的虚拟机上运行它。

$ cd../contents/slax/

$ ./make_iso.sh/home/mtesauro/isos/new-owasp.iso

If anything doesn't work as expected, make the changes needed to./fakeroot and try again.

如果没有达到预期效果，对./fakeroot做一些必要的更改，再试一次。

Cleanup and archive

清理和归档

Once you've got a working module, lets clean up a bit.

一旦你得到了一个可以运行的模块，那就做一下清理吧！

$ $ mkdir./completed_modules/sqlix