Skip to content

Conversation

gouriphadnis0301
Copy link

This PR adds contrib/refresh_token_daemon.py, a cross-platform Python utility designed to automatically refresh authentication tokens for long-running sqlmap runs. It is intended to be used with sqlmap's --eval option to inject fresh tokens into request headers and avoid 401 Unauthorized errors when tokens expire mid-fuzzing.

Key Features:

  • Periodically fetches a new auth token from a configured endpoint.
  • Writes token to a file in an atomic, thread-safe way using file locks.
  • Supports configuration via environment variables:
    • AUTH_URL, AUTH_BODY_JSON, TOKEN_OUT, TOKEN_JSON_KEY, REFRESH_TTL, REFRESH_FREQ.
  • Safe defaults; credentials must be provided via environment variables (not hard-coded).
  • Placed under contrib/ as an auxiliary tool, not core functionality.
  • Cross-platform: works on Windows, macOS, and Linux.

Suggested usage:

export AUTH_URL="https://target.example.com/auth"
export AUTH_BODY_JSON='{"username":"alice","password":"secret"}'
export TOKEN_OUT="/tmp/current_token.txt"
export TOKEN_JSON_KEY="access_token"
python3 contrib/refresh_token_daemon.py &
sqlmap -r request.txt --eval="headers['Authorization']='Bearer ' + open('/tmp/current_token.txt').read().strip()"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant