@memrov2/pentcloud-sqlmap 0.0.0-stage → 0.1.1-dev.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PentCloud contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,3 @@
-# Temporary Holding Version
+# PentCloud sqlmap
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Version 0.1.0 SDK for the native Cloudflare sqlmap tool pack. See the repository [bundle documentation](https://github.com/Memrov/PentCloud-tools/blob/main/docs/bundles.md) for its exact interface, build and limitations. The package exposes the adapter as its main entry point and SqlmapRunner through `./worker`.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,3 @@
+# SQLmap pack notices
+
+SQLmap 1.10 is distributed under GPL-2.0 with the upstream licensing clarifications in its LICENSE. Its complete unmodified source and LICENSE are included in the image under /opt/pentcloud-sqlmap/assets/sqlmap. The Python/Alpine base retains its upstream packages and licenses. See tools.lock.json for the exact source archive and checksum. The separate adapter is MIT licensed; that does not relicense SQLmap.

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@memrov2/pentcloud-sqlmap",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1-dev.0",
+  "type": "module",
+  "license": "MIT",
+  "description": "Cloudflare-native sqlmap tool pack",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Memrov/PentCloud-tools.git",
+    "directory": "packages/sqlmap"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.d.mts",
+      "import": "./src/index.mjs"
+    },
+    "./worker": {
+      "types": "./src/worker.d.mts",
+      "import": "./src/worker.mjs"
+    },
+    "./tools.lock.json": "./tools.lock.json"
+  },
+  "files": [
+    "src",
+    "tools.lock.json",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@memrov2/pentcloud-tool-runtime": "0.1.1-dev.0"
+  }
+}

package/src/index.d.mts

@@ -0,0 +1,9 @@
+import type { ToolCommand, PackLock } from "@memrov2/pentcloud-tool-runtime";
+export type PackRequest = {
+  tool: "sqlmap";
+  target: string;
+  parameter: string;
+  database?: "sqlite" | "mysql" | "postgresql" | "mssql";
+};
+export declare const lock: PackLock;
+export declare function buildCommand(input: PackRequest): ToolCommand;

package/src/index.mjs

@@ -0,0 +1,69 @@
+import { request } from "@memrov2/pentcloud-tool-runtime";
+import lock from "../tools.lock.json" with { type: "json" };
+export { lock };
+export function buildCommand(input) {
+  const url = request(
+    input,
+    ["tool", "target", "parameter", "database"],
+    ["sqlmap"],
+  );
+  if (
+    typeof input.parameter !== "string" ||
+    !/^[A-Za-z_][A-Za-z0-9_.-]{0,63}$/.test(input.parameter) ||
+    url.searchParams.getAll(input.parameter).length !== 1 ||
+    url.href.includes("*")
+  )
+    throw new TypeError("Select exactly one existing query parameter");
+  // SQLmap's explicit -p aliases override --param-filter for these headers.
+  if (
+    [
+      "ua",
+      "useragent",
+      "user-agent",
+      "ref",
+      "referer",
+      "referrer",
+      "host",
+      "cookie",
+    ].includes(input.parameter.toLowerCase())
+  )
+    throw new TypeError(
+      "Reserved SQLmap header aliases are not supported query parameters",
+    );
+  const db = {
+    sqlite: "SQLite",
+    mysql: "MySQL",
+    postgresql: "PostgreSQL",
+    mssql: "Microsoft SQL Server",
+  };
+  if (input.database !== undefined && !Object.hasOwn(db, input.database))
+    throw new TypeError("Unsupported database hint");
+  const args = [
+    "/opt/pentcloud-sqlmap/assets/sqlmap/sqlmap.py",
+    "-u",
+    url.href,
+    "-p",
+    input.parameter,
+    "--batch",
+    "--disable-coloring",
+    "--threads=1",
+    "--delay=0.5",
+    "--timeout=8",
+    "--retries=0",
+    "--risk=1",
+    "--level=1",
+    "--param-filter=GET",
+    "--technique=BE",
+    "--skip-waf",
+    "--ignore-redirects",
+    "--flush-session",
+    "--fresh-queries",
+    "--output-dir=/tmp/pentcloud-sqlmap/results",
+  ];
+  if (input.database) args.push("--dbms", db[input.database]);
+  return {
+    argv: ["/opt/pentcloud-sqlmap/bin/sqlmap", ...args],
+    stdin: "",
+    timeoutMs: 75000,
+  };
+}

package/src/worker.d.mts

@@ -0,0 +1,9 @@
+import { DurableObject } from "cloudflare:workers";
+import type { ToolResult } from "@memrov2/pentcloud-tool-runtime";
+import type { PackRequest } from "./index.mjs";
+export declare class SqlmapRunner extends DurableObject {
+  ready(): Promise<{ image: string; instance: "lite"; readyMs: number }>;
+  run(input: PackRequest): Promise<ToolResult>;
+  retire(): Promise<{ stopped: boolean; retired: true }>;
+  stop(): Promise<{ stopped: boolean }>;
+}

package/src/worker.mjs

@@ -0,0 +1,3 @@
+import { createRunner } from "@memrov2/pentcloud-tool-runtime/worker";
+import { lock, buildCommand } from "./index.mjs";
+export const SqlmapRunner = createRunner(lock, buildCommand);

package/tools.lock.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": 1,
+  "packVersion": "0.1.0",
+  "platform": "linux/amd64",
+  "packId": "sqlmap",
+  "baseImage": "docker.io/library/python@sha256:bdd0cc97663b9b920570d0f1b4601ee18ed895221a0594ca1d9b5e2f26adba83",
+  "tools": [
+    {
+      "tool": "sqlmap",
+      "version": "1.10",
+      "url": "https://codeload.github.com/sqlmapproject/sqlmap/tar.gz/refs/tags/1.10",
+      "format": "sqlmap-tar",
+      "sha256": "aea3bf921d9a2466bc0e33cf43bc941f527eabf7981ec1de104220def3a1cba4"
+    }
+  ],
+  "assets": [],
+  "executables": ["sqlmap"]
+}