Skip to content

Conversation

@gouriphadnis0301
Copy link

This PR adds contrib/refresh_token_daemon.py, a cross-platform Python utility designed to automatically refresh authentication tokens for long-running sqlmap runs. It is intended to be used with sqlmap's --eval option to inject fresh tokens into request headers and avoid 401 Unauthorized errors when tokens expire mid-fuzzing.

Key Features:

  • Periodically fetches a new auth token from a configured endpoint.
  • Writes token to a file in an atomic, thread-safe way using file locks.
  • Supports configuration via environment variables:
    • AUTH_URL, AUTH_BODY_JSON, TOKEN_OUT, TOKEN_JSON_KEY, REFRESH_TTL, REFRESH_FREQ.
  • Safe defaults; credentials must be provided via environment variables (not hard-coded).
  • Placed under contrib/ as an auxiliary tool, not core functionality.
  • Cross-platform: works on Windows, macOS, and Linux.

Suggested usage:

export AUTH_URL="https://target.example.com/auth"
export AUTH_BODY_JSON='{"username":"alice","password":"secret"}'
export TOKEN_OUT="/tmp/current_token.txt"
export TOKEN_JSON_KEY="access_token"
python3 contrib/refresh_token_daemon.py &
sqlmap -r request.txt --eval="headers['Authorization']='Bearer ' + open('/tmp/current_token.txt').read().strip()"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant