sqlmap_gui.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""
SQLMap 中文图形化界面
版本: 2.2.0
支持完整的sqlmap功能，包括os-shell、文件操作、注册表、二阶注入、DNS泄露、MSF集成等深度功能
"""

import os
import sys
import re
import json
import random
import subprocess
import warnings
from datetime import datetime
from pathlib import Path
from typing import Optional, List, Dict

warnings.filterwarnings("ignore", category=DeprecationWarning)

from PyQt5.QtCore import Qt, QThread, pyqtSignal, QSize, QTimer
from PyQt5.QtWidgets import (
    QApplication, QMainWindow, QWidget, QVBoxLayout, QHBoxLayout,
    QTabWidget, QLabel, QLineEdit, QPushButton, QCheckBox, QComboBox,
    QTextEdit, QPlainTextEdit, QGroupBox, QRadioButton, QButtonGroup,
    QSplitter, QFileDialog, QMessageBox, QDialog, QTableWidget,
    QTableWidgetItem, QHeaderView, QProgressBar, QStatusBar, QToolBar,
    QAction, QSpinBox, QFormLayout, QScrollArea, QGridLayout,
    QInputDialog, QSizePolicy
)
from PyQt5.QtGui import QFont, QColor, QTextCharFormat, QSyntaxHighlighter, QTextCursor, QPixmap, QImage, QDesktopServices
from PyQt5.QtCore import QRegularExpression, QUrl

VERSION = "2.2.0"
APP_DIR = Path(__file__).parent.resolve()
LOGS_DIR = APP_DIR / "logs"
CONFIG_FILE = APP_DIR / "data" / "gui_config.json"

LOGS_DIR.mkdir(exist_ok=True)


class SqlmapHighlighter(QSyntaxHighlighter):
    def __init__(self, parent=None):
        super().__init__(parent)
        self.highlightingRules = []
        
        formats = [
            (r"\[CRITICAL\].*|\[ERROR\].*|\[严重\].*|\[错误\].*", "#FF0000", True),
            (r"\[WARNING\].*|\[警告\].*", "#FFA500", False),
            (r"\[INFO\].*|\[信息\].*", "#00AA00", False),
            (r"\[DEBUG\].*|\[调试\].*", "#0000FF", False),
            (r"\[PAYLOAD\].*|\[\*\].*|\[载荷\].*|\[发现\].*", "#800080", True),
            (r"sql-shell|os-shell|os-pwn|os-cmd", "#0066CC", True),
        ]
        
        for pattern, color, bold in formats:
            fmt = QTextCharFormat()
            fmt.setForeground(QColor(color))
            if bold:
                fmt.setFontWeight(QFont.Bold)
            self.highlightingRules.append((QRegularExpression(pattern), fmt))
    
    def highlightBlock(self, text):
        for pattern, fmt in self.highlightingRules:
            match = pattern.match(text)
            if match.hasMatch():
                self.setFormat(match.capturedStart(), match.capturedLength(), fmt)


class CommandThread(QThread):
    output_ready = pyqtSignal(str)
    command_finished = pyqtSignal(int)
    
    def __init__(self, parent=None):
        super().__init__(parent)
        self.command: List[str] = []
        self.process: Optional[subprocess.Popen] = None
        self._stopped = False
    
    def set_command(self, command: List[str]):
        self.command = command
        self._stopped = False
    
    def stop(self):
        self._stopped = True
        if self.process:
            try:
                if sys.platform == "win32":
                    subprocess.run(
                        ["taskkill", "/F", "/T", "/PID", str(self.process.pid)],
                        capture_output=True,
                        timeout=5
                    )
                else:
                    self.process.terminate()
                    self.process.wait(timeout=3)
            except:
                try:
                    self.process.kill()
                except:
                    pass
    
    def run(self):
        try:
            self.process = subprocess.Popen(
                self.command,
                stdout=subprocess.PIPE,
                stderr=subprocess.STDOUT,
                stdin=subprocess.PIPE,
                universal_newlines=True,
                bufsize=1,
                encoding='utf-8',
                errors='replace',
                cwd=str(APP_DIR)
            )
            
            for line in iter(self.process.stdout.readline, ''):
                if self._stopped:
                    break
                self.output_ready.emit(line.rstrip())
            
            self.process.stdout.close()
            return_code = self.process.wait()
            self.command_finished.emit(return_code)
            
        except Exception as e:
            self.output_ready.emit(f"[错误] 命令执行出错: {str(e)}")
            self.command_finished.emit(1)
        finally:
            self.process = None


class InteractiveThread(QThread):
    output_ready = pyqtSignal(str)
    command_finished = pyqtSignal(int)
    
    def __init__(self, parent=None):
        super().__init__(parent)
        self.command: List[str] = []
        self.process: Optional[subprocess.Popen] = None
        self._stopped = False
        self._input_queue: List[str] = []
    
    def set_command(self, command: List[str]):
        self.command = command
        self._stopped = False
    
    def send_input(self, text: str):
        if self.process and self.process.poll() is None:
            try:
                self.process.stdin.write(text + "\n")
                self.process.stdin.flush()
            except:
                pass
    
    def stop(self):
        self._stopped = True
        if self.process:
            try:
                if sys.platform == "win32":
                    subprocess.run(
                        ["taskkill", "/F", "/T", "/PID", str(self.process.pid)],
                        capture_output=True,
                        timeout=5
                    )
                else:
                    self.process.terminate()
                    self.process.wait(timeout=3)
            except:
                try:
                    self.process.kill()
                except:
                    pass
    
    def run(self):
        try:
            self.process = subprocess.Popen(
                self.command,
                stdout=subprocess.PIPE,
                stderr=subprocess.STDOUT,
                stdin=subprocess.PIPE,
                universal_newlines=True,
                bufsize=1,
                encoding='utf-8',
                errors='replace',
                cwd=str(APP_DIR)
            )
            
            for line in iter(self.process.stdout.readline, ''):
                if self._stopped:
                    break
                self.output_ready.emit(line.rstrip())
            
            self.process.stdout.close()
            return_code = self.process.wait()
            self.command_finished.emit(return_code)
            
        except Exception as e:
            self.output_ready.emit(f"[错误] 命令执行出错: {str(e)}")
            self.command_finished.emit(1)
        finally:
            self.process = None


class Translations:
    TRANSLATIONS = {
        "starting": "开始", "the target URL": "目标URL",
        "testing connection to the target URL": "测试与目标URL的连接",
        "checking if the target is protected by some kind of WAF/IPS": "检查目标是否受WAF/IPS保护",
        "testing if the target URL content is stable": "测试目标URL内容是否稳定",
        "target URL content is stable": "目标URL内容稳定",
        "parameter": "参数", "is dynamic": "是动态的",
        "appears to be dynamic": "似乎是动态的",
        "heuristic test shows that": "启发式测试表明",
        "might be injectable": "可能可注入",
        "testing for SQL injection": "测试SQL注入",
        "injection point": "注入点", "back-end DBMS": "后端DBMS",
        "identified": "已识别", "the back-end DBMS is": "后端DBMS是",
        "current user": "当前用户", "current database": "当前数据库",
        "hostname": "主机名", "is DBA": "是DBA",
        "dumping data": "导出数据", "dumped data": "已导出数据",
        "entries": "条目", "connection timed out": "连接超时",
        "execution finished": "执行完成",
        "vulnerability found": "发现漏洞",
        "no SQL injection vulnerability detected": "未检测到SQL注入漏洞",
        "error occurred": "发生错误", "connection error": "连接错误",
        "success": "成功", "failed": "失败",
        "critical": "严重",
        "debug": "调试", "payload": "载荷",
        "retrieved": "已检索", "available databases": "可用数据库",
        "available tables": "可用表",
        "available columns": "可用列",
        "database management system users": "数据库管理系统用户",
        "database user": "数据库用户", "password hash": "密码哈希",
        "privilege": "权限",
        "found": "找到", "not found": "未找到",
        "injectable": "可注入", "not injectable": "不可注入",
        "the target is": "目标是",
        "protected by some kind of WAF/IPS": "受某种WAF/IPS保护",
        "the following injection point": "以下注入点",
        "has been found": "已被发现", "is vulnerable": "是脆弱的",
        "type: ": "类型: ", "title: ": "标题: ",
        "payload: ": "载荷: ", "vector: ": "向量: ",
        "considerable lagging": "明显延迟",
        "HTTP error code": "HTTP错误代码",
        "all tested parameters": "所有测试的参数",
        "do not appear to be injectable": "似乎不可注入",
        "try to increase values for": "尝试增加值",
        "level": "检测级别", "risk": "风险级别",
        "Internal Server Error": "内部服务器错误",
        "times": "次", "ending": "结束",
        "operating system": "操作系统",
        "web application technology": "Web应用技术",
        "web server operating system": "Web服务器操作系统",
        "fetching": "获取", "reading file": "读取文件",
        "writing file": "写入文件", "done": "完成",
        "please enter": "请输入", "command": "命令",
        "prompt": "提示符",
        "banner": "Banner",
        "Database:": "数据库:",
        "Table:": "表:",
        "Column:": "列:",
        "Entry:": "条目:",
    }
    
    @classmethod
    def translate(cls, text: str) -> str:
        sorted_items = sorted(cls.TRANSLATIONS.items(), key=lambda x: -len(x[0]))
        for eng, chn in sorted_items:
            if len(eng) <= 3:
                pattern = r'\b' + re.escape(eng) + r'\b'
                text = re.sub(pattern, chn, text, flags=re.IGNORECASE)
            else:
                text = text.replace(eng, chn)
        return text


class SqlmapGUI(QMainWindow):
    def __init__(self):
        super().__init__()
        
        self.scanning = False
        self.interactive_mode = False
        self.current_log_file: Optional[Path] = None
        self.recent_targets: List[str] = []
        self._extracting_dbs = False
        self._extracting_tables = False
        self._extracting_columns = False
        self._extracting_users = False
        self._current_db_for_tables = ""
        self._info_dirty = False
        self._log_buffer: List[str] = []
        self._is_dark_mode = False
        
        self.extracted_info = {
            "target": "",
            "dbms": "",
            "dbms_version": "",
            "banner": "",
            "os": "",
            "web_server": "",
            "current_user": "",
            "current_db": "",
            "hostname": "",
            "is_dba": "",
            "injection_points": [],
            "databases": [],
            "tables": [],
            "columns": [],
            "users": [],
            "passwords": [],
        }
        
        self._info_timer = QTimer(self)
        self._info_timer.timeout.connect(self._update_info_if_dirty)
        self._info_timer.start(500)
        
        self.command_thread = CommandThread(self)
        self.command_thread.output_ready.connect(self.update_output)
        self.command_thread.command_finished.connect(self.on_command_finished)
        
        self.interactive_thread = InteractiveThread(self)
        self.interactive_thread.output_ready.connect(self.update_output)
        self.interactive_thread.command_finished.connect(self.on_command_finished)
        
        self.load_config()
        self.setup_ui()
        self.check_time_and_set_theme()
        self.new_log_file()
        
        self.update_output(f"[信息] SQLMap中文图形化界面 v{VERSION} 已启动")
        self.update_output(f"[信息] 支持完整功能: os-shell, sql-shell, 文件操作, 注册表操作, 二阶注入, DNS泄露, MSF集成等")
    
    def setup_ui(self):
        self.setWindowTitle(f"SQLMap 中文图形化界面 v{VERSION}")
        self.resize(1400, 900)
        
        self.setup_statusbar()
        self.setup_toolbar()
        self.setup_main_layout()
    
    def check_time_and_set_theme(self):
        current_hour = datetime.now().hour
        is_night = current_hour >= 19 or current_hour < 7
        
        if is_night:
            self.apply_dark_theme()
            QMessageBox.information(
                self,
                "护眼提示",
                "当前是夜晚时段，已自动切换为暗色主题保护您的眼睛。\n\n"
                "建议：\n"
                "• 适当降低屏幕亮度\n"
                "• 保持良好坐姿\n"
                "• 每工作45分钟休息5分钟\n\n"
                "祝您工作愉快！"
            )
    
    def apply_dark_theme(self):
        self._is_dark_mode = True
        dark_style = """
            QMainWindow {
                background-color: #1a1a2e;
            }
            QWidget {
                background-color: #16213e;
                color: #e8e8e8;
                font-family: "Microsoft YaHei", "Segoe UI", sans-serif;
            }
            QTabWidget::pane {
                border: 2px solid #0f3460;
                background-color: #1a1a2e;
                border-radius: 8px;
                margin-top: -1px;
            }
            QTabBar::tab {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #2d3a4f, stop:1 #1a2332);
                color: #a0a0a0;
                border: 1px solid #0f3460;
                border-bottom: none;
                border-top-left-radius: 6px;
                border-top-right-radius: 6px;
                padding: 10px 20px;
                margin-right: 2px;
                font-weight: bold;
            }
            QTabBar::tab:selected {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #0f3460, stop:1 #1a1a2e);
                color: #00d9ff;
                border-color: #00d9ff;
            }
            QTabBar::tab:hover:!selected {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #3d4a5f, stop:1 #2a3342);
                color: #c0c0c0;
            }
            QGroupBox {
                border: 2px solid #0f3460;
                border-radius: 8px;
                margin-top: 12px;
                padding: 15px 10px 10px 10px;
                background-color: #1f2940;
                font-weight: bold;
            }
            QGroupBox::title {
                subcontrol-origin: margin;
                subcontrol-position: top left;
                left: 15px;
                padding: 0 8px;
                color: #00d9ff;
                background-color: #1f2940;
                border-radius: 4px;
            }
            QLineEdit {
                background-color: #0d1b2a;
                color: #e8e8e8;
                border: 2px solid #1b3a5c;
                border-radius: 6px;
                padding: 8px 12px;
                selection-background-color: #00d9ff;
                selection-color: #0d1b2a;
            }
            QLineEdit:hover {
                border-color: #2a5a8c;
            }
            QLineEdit:focus {
                border: 2px solid #00d9ff;
                background-color: #0a1520;
            }
            QLineEdit:disabled {
                background-color: #1a1a2e;
                color: #5a5a5a;
                border-color: #1a2332;
            }
            QTextEdit, QPlainTextEdit {
                background-color: #0a0f1a;
                color: #b8d4e8;
                border: 2px solid #1b3a5c;
                border-radius: 6px;
                padding: 8px;
                selection-background-color: #00d9ff;
                selection-color: #0a0f1a;
            }
            QTextEdit:focus, QPlainTextEdit:focus {
                border-color: #00d9ff;
            }
            QComboBox {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #2d3a4f, stop:1 #1a2332);
                color: #e8e8e8;
                border: 2px solid #1b3a5c;
                border-radius: 6px;
                padding: 6px 12px;
                min-width: 100px;
            }
            QComboBox:hover {
                border-color: #2a5a8c;
            }
            QComboBox:on {
                border-color: #00d9ff;
            }
            QComboBox::drop-down {
                border: none;
                width: 30px;
                border-top-right-radius: 6px;
                border-bottom-right-radius: 6px;
            }
            QComboBox::down-arrow {
                image: none;
                border-left: 6px solid transparent;
                border-right: 6px solid transparent;
                border-top: 8px solid #00d9ff;
                margin-right: 8px;
            }
            QComboBox QAbstractItemView {
                background-color: #1a2332;
                color: #e8e8e8;
                selection-background-color: #0f3460;
                selection-color: #00d9ff;
                border: 2px solid #0f3460;
                border-radius: 6px;
                padding: 4px;
            }
            QSpinBox {
                background-color: #0d1b2a;
                color: #e8e8e8;
                border: 2px solid #1b3a5c;
                border-radius: 6px;
                padding: 6px 10px;
            }
            QSpinBox:hover {
                border-color: #2a5a8c;
            }
            QSpinBox:focus {
                border-color: #00d9ff;
            }
            QSpinBox::up-button, QSpinBox::down-button {
                background-color: #1b3a5c;
                border: none;
                width: 20px;
                border-radius: 3px;
            }
            QSpinBox::up-button:hover, QSpinBox::down-button:hover {
                background-color: #2a5a8c;
            }
            QSpinBox::up-arrow {
                image: none;
                border-left: 5px solid transparent;
                border-right: 5px solid transparent;
                border-bottom: 6px solid #00d9ff;
            }
            QSpinBox::down-arrow {
                image: none;
                border-left: 5px solid transparent;
                border-right: 5px solid transparent;
                border-top: 6px solid #00d9ff;
            }
            QPushButton {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #3a4a6a, stop:1 #2a3a5a);
                color: #e8e8e8;
                border: 2px solid #4a5a7a;
                border-radius: 8px;
                padding: 8px 16px;
                font-weight: bold;
                min-width: 90px;
            }
            QPushButton:hover {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #4a5a7a, stop:1 #3a4a6a);
                border-color: #00d9ff;
                color: #00d9ff;
            }
            QPushButton:pressed {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #2a3a5a, stop:1 #1a2a4a);
            }
            QPushButton:disabled {
                background: #1a2332;
                color: #4a4a4a;
                border-color: #2a2a3a;
            }
            QCheckBox {
                color: #e8e8e8;
                spacing: 10px;
            }
            QCheckBox::indicator {
                width: 22px;
                height: 22px;
                border: 2px solid #3a5a7a;
                border-radius: 5px;
                background-color: #0d1b2a;
            }
            QCheckBox::indicator:hover {
                border-color: #00d9ff;
                background-color: #1a2a3a;
            }
            QCheckBox::indicator:checked {
                background-color: #00d9ff;
                border-color: #00d9ff;
            }
            QCheckBox::indicator:disabled {
                background-color: #1a1a2e;
                border-color: #2a2a3a;
            }
            QRadioButton {
                color: #e8e8e8;
                spacing: 10px;
            }
            QRadioButton::indicator {
                width: 22px;
                height: 22px;
                border: 2px solid #3a5a7a;
                border-radius: 11px;
                background-color: #0d1b2a;
            }
            QRadioButton::indicator:hover {
                border-color: #00d9ff;
                background-color: #1a2a3a;
            }
            QRadioButton::indicator:checked {
                border: 3px solid #00d9ff;
                background: qradialgradient(cx:0.5, cy:0.5, radius:0.4,
                    fx:0.5, fy:0.5,
                    stop:0 #00d9ff, stop:0.6 #00d9ff, stop:0.7 #0d1b2a);
            }
            QRadioButton::indicator:disabled {
                background-color: #1a1a2e;
                border-color: #2a2a3a;
            }
            QTableWidget {
                background-color: #0a0f1a;
                color: #b8d4e8;
                gridline-color: #1b3a5c;
                border: 2px solid #0f3460;
                border-radius: 8px;
                selection-background-color: #0f3460;
                selection-color: #00d9ff;
            }
            QTableWidget::item {
                padding: 8px;
                border-bottom: 1px solid #1b3a5c;
            }
            QTableWidget::item:hover {
                background-color: #1a2332;
            }
            QHeaderView::section {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #2a3a5a, stop:1 #1a2a4a);
                color: #00d9ff;
                border: none;
                border-bottom: 2px solid #0f3460;
                padding: 10px;
                font-weight: bold;
            }
            QHeaderView::section:hover {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #3a4a6a, stop:1 #2a3a5a);
            }
            QProgressBar {
                border: 2px solid #0f3460;
                border-radius: 8px;
                text-align: center;
                background-color: #0d1b2a;
                color: #e8e8e8;
                font-weight: bold;
                height: 24px;
            }
            QProgressBar::chunk {
                background: qlineargradient(x1:0, y1:0, x2:1, y2:0,
                    stop:0 #00d9ff, stop:0.5 #00ff88, stop:1 #00d9ff);
                border-radius: 6px;
            }
            QScrollBar:vertical {
                background-color: #0a0f1a;
                width: 14px;
                border: none;
                border-radius: 7px;
                margin: 2px;
            }
            QScrollBar::handle:vertical {
                background: qlineargradient(x1:0, y1:0, x2:1, y2:0,
                    stop:0 #1b3a5c, stop:1 #0f3460);
                border-radius: 7px;
                min-height: 40px;
            }
            QScrollBar::handle:vertical:hover {
                background: qlineargradient(x1:0, y1:0, x2:1, y2:0,
                    stop:0 #2a5a8c, stop:1 #1b4a6c);
            }
            QScrollBar::add-line:vertical, QScrollBar::sub-line:vertical {
                height: 0px;
            }
            QScrollBar::add-page:vertical, QScrollBar::sub-page:vertical {
                background: none;
            }
            QScrollBar:horizontal {
                background-color: #0a0f1a;
                height: 14px;
                border: none;
                border-radius: 7px;
                margin: 2px;
            }
            QScrollBar::handle:horizontal {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #1b3a5c, stop:1 #0f3460);
                border-radius: 7px;
                min-width: 40px;
            }
            QScrollBar::handle:horizontal:hover {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #2a5a8c, stop:1 #1b4a6c);
            }
            QScrollBar::add-line:horizontal, QScrollBar::sub-line:horizontal {
                width: 0px;
            }
            QToolBar {
                background: qlineargradient(x1:0, y1:0, x2:0, y2:1,
                    stop:0 #1f2940, stop:1 #16213e);
                border: none;
                border-bottom: 2px solid #0f3460;
                spacing: 8px;
                padding: 8px;
            }
            QToolBar QToolButton, QToolBar QAction {
                background: transparent;
                color: #a0a0a0;
                border: 2px solid transparent;
                border-radius: 6px;
                padding: 8px 12px;
                font-weight: bold;
            }
            QToolBar QToolButton:hover {
                background-color: #0f3460;
                color: #00d9ff;
                border-color: #00d9ff;
            }
            QToolBar QToolButton:pressed {
                background-color: #1a2332;
            }
            QStatusBar {
                background: qlineargradient(x1:0, y1:0, x2:1, y2:0,
                    stop:0 #0f3460, stop:0.5 #00d9ff, stop:1 #0f3460);
                color: #ffffff;
                font-weight: bold;
                border-top: 2px solid #00d9ff;
            }
            QSplitter::handle {
                background: qlineargradient(x1:0, y1:0, x2:1, y2:0,
                    stop:0 transparent, stop:0.4 #0f3460, stop:0.6 #0f3460, stop:1 transparent);
                height: 4px;
            }
            QSplitter::handle:hover {
                background: qlineargradient(x1:0, y1:0, x2:1, y2:0,
                    stop:0 transparent, stop:0.4 #00d9ff, stop:0.6 #00d9ff, stop:1 transparent);
            }
            QToolTip {
                background-color: #1a2332;
                color: #00d9ff;
                border: 2px solid #0f3460;
                border-radius: 6px;
                padding: 6px 10px;
            }
            QMenu {
                background-color: #1a2332;
                color: #e8e8e8;
                border: 2px solid #0f3460;
                border-radius: 8px;
                padding: 6px;
            }
            QMenu::item {
                padding: 8px 30px 8px 20px;
                border-radius: 4px;
            }
            QMenu::item:selected {
                background-color: #0f3460;
                color: #00d9ff;
            }
            QMenu::separator {
                height: 2px;
                background: #0f3460;
                margin: 6px 10px;
            }
            QScrollBar QAbstractSlider {
                background: transparent;
            }
            QFrame {
                border-radius: 8px;
            }
            QFrame[frameShape="4"] {
                background-color: #0f3460;
            }
            QFrame[frameShape="5"] {
                background-color: #0f3460;
            }
        """
        self.setStyleSheet(dark_style)
    
    def apply_light_theme(self):
        self._is_dark_mode = False
        self.setStyleSheet("")
    
    def toggle_theme(self):
        if self._is_dark_mode:
            self.apply_light_theme()
        else:
            self.apply_dark_theme()
    
    def setup_statusbar(self):
        self.statusBar = QStatusBar()
        self.setStatusBar(self.statusBar)
        self.statusBar.showMessage("就绪")
    
    def setup_toolbar(self):
        self.toolbar = QToolBar("主工具栏")
        self.toolbar.setIconSize(QSize(24, 24))
        self.addToolBar(self.toolbar)
        
        self.start_action = QAction("开始扫描", self)
        self.start_action.triggered.connect(self.start_scan)
        self.toolbar.addAction(self.start_action)
        
        self.stop_action = QAction("停止", self)
        self.stop_action.triggered.connect(self.stop_scan)
        self.stop_action.setEnabled(False)
        self.toolbar.addAction(self.stop_action)
        
        self.toolbar.addSeparator()
        
        self.save_config_action = QAction("保存配置", self)
        self.save_config_action.triggered.connect(self.save_config)
        self.toolbar.addAction(self.save_config_action)
        
        self.toolbar.addSeparator()
        
        self.report_action = QAction("生成报告", self)
        self.report_action.triggered.connect(self.generate_report)
        self.toolbar.addAction(self.report_action)
        
        self.history_action = QAction("历史记录", self)
        self.history_action.triggered.connect(self.show_history)
        self.toolbar.addAction(self.history_action)
        
        self.toolbar.addSeparator()
        
        self.help_action = QAction("帮助", self)
        self.help_action.triggered.connect(self.show_help)
        self.toolbar.addAction(self.help_action)
        
        self.toolbar.addSeparator()
        
        self.theme_action = QAction("切换主题", self)
        self.theme_action.triggered.connect(self.toggle_theme)
        self.toolbar.addAction(self.theme_action)
        
        self.toolbar.addSeparator()
        
        self.contact_action = QAction("联系作者", self)
        self.contact_action.triggered.connect(self.show_contact_dialog)
        self.toolbar.addAction(self.contact_action)
    
    def setup_main_layout(self):
        main_widget = QWidget()
        self.setCentralWidget(main_widget)
        main_layout = QVBoxLayout(main_widget)
        
        splitter = QSplitter(Qt.Horizontal)
        main_layout.addWidget(splitter)
        
        left_panel = self.create_left_panel()
        splitter.addWidget(left_panel)
        
        right_panel = self.create_right_panel()
        splitter.addWidget(right_panel)
        
        splitter.setSizes([500, 900])
        
        self.progress_bar = QProgressBar()
        self.progress_bar.setTextVisible(True)
        self.progress_bar.setFormat("就绪")
        self.progress_bar.setValue(0)
        main_layout.addWidget(self.progress_bar)
    
    def create_left_panel(self) -> QWidget:
        panel = QWidget()
        layout = QVBoxLayout(panel)
        
        self.tabs = QTabWidget()
        
        self.tabs.addTab(self.create_basic_tab(), "基本设置")
        self.tabs.addTab(self.create_enumeration_tab(), "枚举选项")
        self.tabs.addTab(self.create_os_access_tab(), "系统访问")
        self.tabs.addTab(self.create_file_tab(), "文件操作")
        self.tabs.addTab(self.create_registry_tab(), "注册表")
        self.tabs.addTab(self.create_injection_tab(), "注入选项")
        self.tabs.addTab(self.create_advanced_tab(), "高级设置")
        self.tabs.addTab(self.create_command_tab(), "命令预览")
        
        layout.addWidget(self.tabs)
        
        buttons_layout = QHBoxLayout()
        
        self.start_button = QPushButton("开始扫描")
        self.start_button.clicked.connect(self.start_scan)
        
        self.stop_button = QPushButton("停止")
        self.stop_button.clicked.connect(self.stop_scan)
        self.stop_button.setEnabled(False)
        
        buttons_layout.addWidget(self.start_button)
        buttons_layout.addWidget(self.stop_button)
        layout.addLayout(buttons_layout)
        
        return panel
    
    def create_basic_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        layout.addWidget(self.create_target_group())
        layout.addWidget(self.create_detection_group())
        layout.addWidget(self.create_technique_group())
        layout.addWidget(self.create_dbms_group())
        layout.addStretch()
        
        return tab
    
    def create_target_group(self) -> QGroupBox:
        group = QGroupBox("目标设置")
        layout = QVBoxLayout(group)
        
        url_layout = QHBoxLayout()
        url_layout.addWidget(QLabel("URL:"))
        self.url_input = QComboBox()
        self.url_input.setEditable(True)
        self.url_input.setInsertPolicy(QComboBox.InsertAtTop)
        self.url_input.lineEdit().setPlaceholderText("http://example.com/page.php?id=1")
        for target in self.recent_targets[:10]:
            self.url_input.addItem(target)
        url_layout.addWidget(self.url_input)
        layout.addLayout(url_layout)
        
        request_layout = QHBoxLayout()
        request_layout.addWidget(QLabel("请求文件:"))
        self.request_file_input = QLineEdit()
        self.request_file_input.setPlaceholderText("选择包含HTTP请求的文件")
        request_btn = QPushButton("浏览")
        request_btn.clicked.connect(self.select_request_file)
        request_layout.addWidget(self.request_file_input)
        request_layout.addWidget(request_btn)
        layout.addLayout(request_layout)
        
        cookie_layout = QHBoxLayout()
        cookie_layout.addWidget(QLabel("Cookie:"))
        self.cookie_input = QLineEdit()
        self.cookie_input.setPlaceholderText("PHPSESSID=xxx; security=low")
        cookie_layout.addWidget(self.cookie_input)
        layout.addLayout(cookie_layout)
        
        data_layout = QHBoxLayout()
        data_layout.addWidget(QLabel("POST数据:"))
        self.post_data_input = QLineEdit()
        self.post_data_input.setPlaceholderText("id=1&name=test")
        data_layout.addWidget(self.post_data_input)
        layout.addLayout(data_layout)
        
        return group
    
    def create_detection_group(self) -> QGroupBox:
        group = QGroupBox("检测设置")
        layout = QHBoxLayout(group)
        
        level_group = QGroupBox("检测级别")
        level_layout = QHBoxLayout(level_group)
        self.level_buttons = QButtonGroup()
        for i in range(1, 6):
            rb = QRadioButton(str(i))
            if i == 1:
                rb.setChecked(True)
            self.level_buttons.addButton(rb, i)
            level_layout.addWidget(rb)
        layout.addWidget(level_group)
        
        risk_group = QGroupBox("风险级别")
        risk_layout = QHBoxLayout(risk_group)
        self.risk_buttons = QButtonGroup()
        for i in range(1, 4):
            rb = QRadioButton(str(i))
            if i == 1:
                rb.setChecked(True)
            self.risk_buttons.addButton(rb, i)
            risk_layout.addWidget(rb)
        layout.addWidget(risk_group)
        
        return group
    
    def create_technique_group(self) -> QGroupBox:
        group = QGroupBox("注入技术")
        layout = QHBoxLayout(group)
        
        self.technique_checkboxes: Dict[str, QCheckBox] = {}
        techniques = [
            ("B", "布尔盲注"), ("E", "报错注入"), ("U", "联合查询"),
            ("S", "堆叠查询"), ("T", "时间盲注"), ("Q", "内联查询")
        ]
        
        for code, name in techniques:
            cb = QCheckBox(f"{name}")
            cb.setChecked(True)
            cb.setToolTip(f"{name} ({code})")
            self.technique_checkboxes[code] = cb
            layout.addWidget(cb)
        
        return group
    
    def create_dbms_group(self) -> QGroupBox:
        group = QGroupBox("数据库类型")
        layout = QHBoxLayout(group)
        
        layout.addWidget(QLabel("DBMS:"))
        self.dbms_combo = QComboBox()
        self.dbms_combo.addItem("自动检测", "")
        for dbms in ["MySQL", "Oracle", "PostgreSQL", "Microsoft SQL Server", 
                     "SQLite", "IBM DB2", "Firebird", "Sybase", "HSQLDB", "Informix"]:
            self.dbms_combo.addItem(dbms, dbms)
        layout.addWidget(self.dbms_combo)
        layout.addStretch()
        
        return group
    
    def create_enumeration_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        info_group = QGroupBox("信息获取")
        info_layout = QHBoxLayout(info_group)
        
        left_col = QVBoxLayout()
        self.current_user_check = QCheckBox("当前用户")
        self.current_db_check = QCheckBox("当前数据库")
        self.hostname_check = QCheckBox("主机名")
        self.is_dba_check = QCheckBox("DBA权限")
        self.banner_check = QCheckBox("数据库版本")
        self.comments_check = QCheckBox("检查注释")
        left_col.addWidget(self.current_user_check)
        left_col.addWidget(self.current_db_check)
        left_col.addWidget(self.hostname_check)
        left_col.addWidget(self.is_dba_check)
        left_col.addWidget(self.banner_check)
        left_col.addWidget(self.comments_check)
        
        right_col = QVBoxLayout()
        self.passwords_check = QCheckBox("密码哈希")
        self.privileges_check = QCheckBox("用户权限")
        self.roles_check = QCheckBox("用户角色")
        self.users_check = QCheckBox("用户列表")
        self.schema_check = QCheckBox("数据库架构")
        right_col.addWidget(self.passwords_check)
        right_col.addWidget(self.privileges_check)
        right_col.addWidget(self.roles_check)
        right_col.addWidget(self.users_check)
        right_col.addWidget(self.schema_check)
        
        info_layout.addLayout(left_col)
        info_layout.addLayout(right_col)
        layout.addWidget(info_group)
        
        data_group = QGroupBox("数据枚举")
        data_layout = QHBoxLayout(data_group)
        
        left_data = QVBoxLayout()
        self.dbs_check = QCheckBox("数据库列表")
        self.tables_check = QCheckBox("表列表")
        self.columns_check = QCheckBox("列列表")
        self.count_check = QCheckBox("记录数统计")
        left_data.addWidget(self.dbs_check)
        left_data.addWidget(self.tables_check)
        left_data.addWidget(self.columns_check)
        left_data.addWidget(self.count_check)
        
        right_data = QVBoxLayout()
        self.dump_check = QCheckBox("导出数据")
        self.dump_all_check = QCheckBox("导出所有")
        self.dump_format_combo = QComboBox()
        self.dump_format_combo.addItems(["CSV", "HTML", "SQLITE"])
        right_data.addWidget(self.dump_check)
        right_data.addWidget(self.dump_all_check)
        right_data.addWidget(QLabel("导出格式:"))
        right_data.addWidget(self.dump_format_combo)
        
        data_layout.addLayout(left_data)
        data_layout.addLayout(right_data)
        layout.addWidget(data_group)
        
        specific_group = QGroupBox("指定枚举")
        specific_layout = QFormLayout(specific_group)
        
        self.db_input = QLineEdit()
        self.db_input.setPlaceholderText("数据库名")
        specific_layout.addRow("数据库(-D):", self.db_input)
        
        self.table_input = QLineEdit()
        self.table_input.setPlaceholderText("表名")
        specific_layout.addRow("表(-T):", self.table_input)
        
        self.column_input = QLineEdit()
        self.column_input.setPlaceholderText("列名")
        specific_layout.addRow("列(-C):", self.column_input)
        
        self.where_input = QLineEdit()
        self.where_input.setPlaceholderText("WHERE条件")
        specific_layout.addRow("条件(--where):", self.where_input)
        
        self.start_input = QSpinBox()
        self.start_input.setRange(0, 999999)
        self.start_input.setValue(0)
        specific_layout.addRow("起始行(--start):", self.start_input)
        
        self.stop_input = QSpinBox()
        self.stop_input.setRange(0, 999999)
        self.stop_input.setValue(0)
        specific_layout.addRow("结束行(--stop):", self.stop_input)
        
        layout.addWidget(specific_group)
        layout.addStretch()
        
        return tab
    
    def create_os_access_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        shell_group = QGroupBox("交互式Shell")
        shell_layout = QVBoxLayout(shell_group)
        
        row1 = QHBoxLayout()
        self.os_shell_check = QCheckBox("os-shell (交互式系统Shell)")
        self.os_shell_check.setToolTip("获取一个交互式操作系统Shell")
        self.sql_shell_check = QCheckBox("sql-shell (交互式SQL Shell)")
        self.sql_shell_check.setToolTip("获取一个交互式SQL Shell")
        row1.addWidget(self.os_shell_check)
        row1.addWidget(self.sql_shell_check)
        row1.addStretch()
        shell_layout.addLayout(row1)
        
        layout.addWidget(shell_group)
        
        cmd_group = QGroupBox("命令执行")
        cmd_layout = QVBoxLayout(cmd_group)
        
        self.os_cmd_check = QCheckBox("os-cmd (执行单个系统命令)")
        cmd_layout.addWidget(self.os_cmd_check)
        
        cmd_input_layout = QHBoxLayout()
        cmd_input_layout.addWidget(QLabel("命令:"))
        self.os_cmd_input = QLineEdit()
        self.os_cmd_input.setPlaceholderText("whoami, net user, dir 等")
        cmd_input_layout.addWidget(self.os_cmd_input)
        cmd_layout.addLayout(cmd_input_layout)
        
        layout.addWidget(cmd_group)
        
        pwn_group = QGroupBox("高级利用")
        pwn_layout = QVBoxLayout(pwn_group)
        
        row2 = QHBoxLayout()
        self.os_pwn_check = QCheckBox("os-pwn (Meterpreter/VNC)")
        self.os_pwn_check.setToolTip("通过UDF执行提权或Meterpreter/VNC会话")
        self.os_smbrelay_check = QCheckBox("os-smbrelay (SMB中继)")
        self.os_smbrelay_check.setToolTip("SMB中继攻击")
        row2.addWidget(self.os_pwn_check)
        row2.addWidget(self.os_smbrelay_check)
        row2.addStretch()
        pwn_layout.addLayout(row2)
        
        priv_layout = QHBoxLayout()
        self.priv_esc_check = QCheckBox("priv-esc (权限提升)")
        self.priv_esc_check.setToolTip("尝试数据库进程权限提升")
        priv_layout.addWidget(self.priv_esc_check)
        priv_layout.addStretch()
        pwn_layout.addLayout(priv_layout)
        
        layout.addWidget(pwn_group)
        
        exec_group = QGroupBox("执行方式")
        exec_layout = QFormLayout(exec_group)
        
        self.exec_func_combo = QComboBox()
        self.exec_func_combo.addItems(["自动选择", "exec", "eval", "system", "passthru", "shell_exec", "popen"])
        exec_layout.addRow("执行函数:", self.exec_func_combo)
        
        self.os_shell_type_combo = QComboBox()
        self.os_shell_type_combo.addItems(["自动", "web", "xp_cmdshell", "sp_OACreate"])
        exec_layout.addRow("Shell类型:", self.os_shell_type_combo)
        
        layout.addWidget(exec_group)
        
        msf_group = QGroupBox("Metasploit集成")
        msf_layout = QFormLayout(msf_group)
        
        self.msf_path_input = QLineEdit()
        self.msf_path_input.setPlaceholderText("Metasploit框架路径 (如: /usr/share/metasploit-framework)")
        msf_layout.addRow("MSF路径:", self.msf_path_input)
        
        self.tmp_path_input = QLineEdit()
        self.tmp_path_input.setPlaceholderText("服务器临时目录 (如: /tmp, C:\\Windows\\Temp)")
        msf_layout.addRow("临时目录:", self.tmp_path_input)
        
        layout.addWidget(msf_group)
        
        self.os_group = QGroupBox("操作系统设置")
        os_layout = QVBoxLayout(self.os_group)
        
        os_row = QHBoxLayout()
        os_row.addWidget(QLabel("后端操作系统:"))
        self.os_combo = QComboBox()
        self.os_combo.addItems(["自动检测", "Linux", "Windows"])
        self.os_combo.setToolTip("强制指定后端DBMS操作系统类型，或自动检测")
        os_row.addWidget(self.os_combo)
        os_row.addStretch()
        os_layout.addLayout(os_row)
        
        layout.addWidget(self.os_group)
        layout.addStretch()
        
        return tab
    
    def create_file_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        read_group = QGroupBox("文件读取")
        read_layout = QVBoxLayout(read_group)
        
        self.file_read_check = QCheckBox("读取服务器文件")
        read_layout.addWidget(self.file_read_check)
        
        file_read_layout = QHBoxLayout()
        file_read_layout.addWidget(QLabel("文件路径:"))
        self.file_read_input = QLineEdit()
        self.file_read_input.setPlaceholderText("/etc/passwd, C:\\Windows\\System32\\config\\SAM 等")
        file_read_layout.addWidget(self.file_read_input)
        read_layout.addLayout(file_read_layout)
        
        layout.addWidget(read_group)
        
        write_group = QGroupBox("文件写入")
        write_layout = QVBoxLayout(write_group)
        
        self.file_write_check = QCheckBox("写入文件到服务器")
        write_layout.addWidget(self.file_write_check)
        
        file_local_layout = QHBoxLayout()
        file_local_layout.addWidget(QLabel("本地文件:"))
        self.file_write_local_input = QLineEdit()
        self.file_write_local_input.setPlaceholderText("本地要上传的文件路径")
        file_local_layout.addWidget(self.file_write_local_input)
        browse_btn = QPushButton("浏览")
        browse_btn.clicked.connect(lambda: self.select_file(self.file_write_local_input))
        file_local_layout.addWidget(browse_btn)
        write_layout.addLayout(file_local_layout)
        
        file_dest_layout = QHBoxLayout()
        file_dest_layout.addWidget(QLabel("目标路径:"))
        self.file_write_dest_input = QLineEdit()
        self.file_write_dest_input.setPlaceholderText("服务器上的目标路径")
        file_dest_layout.addWidget(self.file_write_dest_input)
        write_layout.addLayout(file_dest_layout)
        
        layout.addWidget(write_group)
        
        web_group = QGroupBox("Web文件操作")
        web_layout = QVBoxLayout(web_group)
        
        self.web_file_check = QCheckBox("检测Web文件")
        web_layout.addWidget(self.web_file_check)
        
        web_root_layout = QHBoxLayout()
        web_root_layout.addWidget(QLabel("Web根目录:"))
        self.web_root_input = QLineEdit()
        self.web_root_input.setPlaceholderText("Web服务器根目录路径")
        web_root_layout.addWidget(self.web_root_input)
        web_layout.addLayout(web_root_layout)
        
        layout.addWidget(web_group)
        
        upload_group = QGroupBox("上传功能")
        upload_layout = QVBoxLayout(upload_group)
        
        self.upload_check = QCheckBox("检测文件上传功能")
        upload_layout.addWidget(self.upload_check)
        
        upload_layout_h = QHBoxLayout()
        upload_layout_h.addWidget(QLabel("上传接口:"))
        self.upload_url_input = QLineEdit()
        self.upload_url_input.setPlaceholderText("上传接口URL")
        upload_layout_h.addWidget(self.upload_url_input)
        upload_layout.addLayout(upload_layout_h)
        
        layout.addWidget(upload_group)
        layout.addStretch()
        
        return tab
    
    def create_registry_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        note_label = QLabel("注意: 注册表操作仅适用于Windows + MySQL/MSSQL/Oracle")
        note_label.setStyleSheet("color: orange; font-weight: bold;")
        layout.addWidget(note_label)
        
        reg_group = QGroupBox("注册表操作")
        reg_layout = QVBoxLayout(reg_group)
        
        reg_row1 = QHBoxLayout()
        self.reg_read_check = QCheckBox("读取注册表")
        self.reg_add_check = QCheckBox("添加注册表")
        self.reg_del_check = QCheckBox("删除注册表")
        reg_row1.addWidget(self.reg_read_check)
        reg_row1.addWidget(self.reg_add_check)
        reg_row1.addWidget(self.reg_del_check)
        reg_row1.addStretch()
        reg_layout.addLayout(reg_row1)
        
        layout.addWidget(reg_group)
        
        reg_key_group = QGroupBox("注册表键值")
        reg_key_layout = QFormLayout(reg_key_group)
        
        self.reg_key_input = QLineEdit()
        self.reg_key_input.setPlaceholderText("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion")
        reg_key_layout.addRow("键路径:", self.reg_key_input)
        
        self.reg_val_input = QLineEdit()
        self.reg_val_input.setPlaceholderText("注册表值名称")
        reg_key_layout.addRow("值名称:", self.reg_val_input)
        
        self.reg_data_input = QLineEdit()
        self.reg_data_input.setPlaceholderText("要写入的数据")
        reg_key_layout.addRow("数据:", self.reg_data_input)
        
        self.reg_type_combo = QComboBox()
        self.reg_type_combo.addItems(["REG_SZ", "REG_DWORD", "REG_BINARY", "REG_EXPAND_SZ"])
        reg_key_layout.addRow("数据类型:", self.reg_type_combo)
        
        layout.addWidget(reg_key_group)
        layout.addStretch()
        
        return tab
    
    def create_injection_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        inject_group = QGroupBox("注入点设置")
        inject_layout = QFormLayout(inject_group)
        
        self.prefix_input = QLineEdit()
        self.prefix_input.setPlaceholderText("注入payload前缀")
        inject_layout.addRow("Prefix:", self.prefix_input)
        
        self.suffix_input = QLineEdit()
        self.suffix_input.setPlaceholderText("注入payload后缀")
        inject_layout.addRow("Suffix:", self.suffix_input)
        
        self.test_filter_input = QLineEdit()
        self.test_filter_input.setPlaceholderText("只使用匹配的测试")
        inject_layout.addRow("Test Filter:", self.test_filter_input)
        
        self.test_skip_input = QLineEdit()
        self.test_skip_input.setPlaceholderText("跳过匹配的测试")
        inject_layout.addRow("Test Skip:", self.test_skip_input)
        
        layout.addWidget(inject_group)
        
        param_group = QGroupBox("参数设置")
        param_layout = QFormLayout(param_group)
        
        self.param_del_input = QLineEdit()
        self.param_del_input.setPlaceholderText("参数分隔符")
        param_layout.addRow("参数分隔符:", self.param_del_input)
        
        self.cookie_del_input = QLineEdit()
        self.cookie_del_input.setPlaceholderText("Cookie分隔符")
        param_layout.addRow("Cookie分隔符:", self.cookie_del_input)
        
        self.skip_static_check = QCheckBox("跳过静态参数")
        param_layout.addRow(self.skip_static_check)
        
        layout.addWidget(param_group)
        
        auth_group = QGroupBox("认证设置")
        auth_layout = QFormLayout(auth_group)
        
        self.auth_type_combo = QComboBox()
        self.auth_type_combo.addItems(["无", "Basic", "Digest", "NTLM"])
        auth_layout.addRow("认证类型:", self.auth_type_combo)
        
        self.auth_user_input = QLineEdit()
        self.auth_user_input.setPlaceholderText("用户名")
        auth_layout.addRow("用户名:", self.auth_user_input)
        
        self.auth_pass_input = QLineEdit()
        self.auth_pass_input.setPlaceholderText("密码")
        self.auth_pass_input.setEchoMode(QLineEdit.Password)
        auth_layout.addRow("密码:", self.auth_pass_input)
        
        layout.addWidget(auth_group)
        
        dbms_cred_group = QGroupBox("数据库凭据")
        dbms_cred_layout = QFormLayout(dbms_cred_group)
        
        self.dbms_user_input = QLineEdit()
        self.dbms_user_input.setPlaceholderText("数据库用户名")
        dbms_cred_layout.addRow("用户名:", self.dbms_user_input)
        
        self.dbms_pass_input = QLineEdit()
        self.dbms_pass_input.setPlaceholderText("数据库密码")
        self.dbms_pass_input.setEchoMode(QLineEdit.Password)
        dbms_cred_layout.addRow("密码:", self.dbms_pass_input)
        
        layout.addWidget(dbms_cred_group)
        
        second_order_group = QGroupBox("二阶注入")
        second_order_layout = QFormLayout(second_order_group)
        
        self.second_order_check = QCheckBox("启用二阶注入")
        second_order_layout.addRow(self.second_order_check)
        
        self.second_order_input = QLineEdit()
        self.second_order_input.setPlaceholderText("二阶注入响应页面URL")
        second_order_layout.addRow("响应URL:", self.second_order_input)
        
        layout.addWidget(second_order_group)
        
        dns_group = QGroupBox("DNS泄露攻击")
        dns_layout = QFormLayout(dns_group)
        
        self.dns_domain_input = QLineEdit()
        self.dns_domain_input.setPlaceholderText("你控制的域名 (如: attacker.com)")
        dns_layout.addRow("DNS域名:", self.dns_domain_input)
        
        dns_note = QLabel("需要你控制该域名的DNS服务器")
        dns_note.setStyleSheet("color: orange;")
        dns_layout.addRow(dns_note)
        
        layout.addWidget(dns_group)
        
        safe_group = QGroupBox("安全请求设置")
        safe_layout = QFormLayout(safe_group)
        
        self.safe_url_input = QLineEdit()
        self.safe_url_input.setPlaceholderText("安全URL，用于保持会话")
        safe_layout.addRow("安全URL:", self.safe_url_input)
        
        self.safe_freq_input = QSpinBox()
        self.safe_freq_input.setRange(1, 1000)
        self.safe_freq_input.setValue(0)
        safe_layout.addRow("请求频率:", self.safe_freq_input)
        
        self.safe_req_check = QCheckBox("使用安全请求")
        safe_layout.addRow(self.safe_req_check)
        
        layout.addWidget(safe_group)
        
        direct_group = QGroupBox("直接数据库连接")
        direct_layout = QFormLayout(direct_group)
        
        self.direct_check = QCheckBox("直接连接数据库")
        self.direct_check.setToolTip("通过数据库客户端直接连接，而非SQL注入")
        direct_layout.addRow(self.direct_check)
        
        self.direct_conn_input = QLineEdit()
        self.direct_conn_input.setPlaceholderText("数据库连接字符串 (如: mysql://user:pass@host:port/db)")
        direct_layout.addRow("连接字符串:", self.direct_conn_input)
        
        layout.addWidget(direct_group)
        layout.addStretch()
        
        return tab
    
    def create_advanced_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        scroll = QScrollArea()
        scroll.setWidgetResizable(True)
        scroll_content = QWidget()
        scroll_layout = QVBoxLayout(scroll_content)
        
        scroll_layout.addWidget(self.create_connection_group())
        scroll_layout.addWidget(self.create_proxy_group())
        scroll_layout.addWidget(self.create_headers_group())
        scroll_layout.addWidget(self.create_tamper_group())
        scroll_layout.addWidget(self.create_options_group())
        scroll_layout.addWidget(self.create_custom_group())
        scroll_layout.addStretch()
        
        scroll.setWidget(scroll_content)
        layout.addWidget(scroll)
        
        return tab
    
    def create_connection_group(self) -> QGroupBox:
        group = QGroupBox("连接设置")
        layout = QFormLayout(group)
        
        threads_layout = QHBoxLayout()
        self.threads_spin = QSpinBox()
        self.threads_spin.setRange(1, 10)
        self.threads_spin.setValue(1)
        threads_layout.addWidget(self.threads_spin)
        threads_layout.addStretch()
        layout.addRow("线程数:", threads_layout)
        
        timeout_layout = QHBoxLayout()
        self.timeout_spin = QSpinBox()
        self.timeout_spin.setRange(5, 120)
        self.timeout_spin.setValue(30)
        timeout_layout.addWidget(self.timeout_spin)
        timeout_layout.addWidget(QLabel("秒"))
        timeout_layout.addStretch()
        layout.addRow("超时时间:", timeout_layout)
        
        delay_layout = QHBoxLayout()
        self.delay_spin = QSpinBox()
        self.delay_spin.setRange(0, 60)
        self.delay_spin.setValue(0)
        delay_layout.addWidget(self.delay_spin)
        delay_layout.addWidget(QLabel("秒"))
        delay_layout.addStretch()
        layout.addRow("请求延迟:", delay_layout)
        
        retries_layout = QHBoxLayout()
        self.retries_spin = QSpinBox()
        self.retries_spin.setRange(0, 10)
        self.retries_spin.setValue(3)
        retries_layout.addWidget(self.retries_spin)
        retries_layout.addStretch()
        layout.addRow("重试次数:", retries_layout)
        
        return group
    
    def create_proxy_group(self) -> QGroupBox:
        group = QGroupBox("代理设置")
        layout = QVBoxLayout(group)
        
        proxy_layout = QHBoxLayout()
        proxy_layout.addWidget(QLabel("代理:"))
        self.proxy_input = QLineEdit()
        self.proxy_input.setPlaceholderText("http://127.0.0.1:8080")
        proxy_layout.addWidget(self.proxy_input)
        layout.addLayout(proxy_layout)
        
        proxy_cred_layout = QHBoxLayout()
        proxy_cred_layout.addWidget(QLabel("代理认证:"))
        self.proxy_user_input = QLineEdit()
        self.proxy_user_input.setPlaceholderText("用户名")
        self.proxy_pass_input = QLineEdit()
        self.proxy_pass_input.setPlaceholderText("密码")
        proxy_cred_layout.addWidget(self.proxy_user_input)
        proxy_cred_layout.addWidget(self.proxy_pass_input)
        layout.addLayout(proxy_cred_layout)
        
        proxy_check_layout = QHBoxLayout()
        self.proxy_check = QCheckBox("使用代理")
        self.tor_check = QCheckBox("使用Tor")
        self.tor_port_input = QSpinBox()
        self.tor_port_input.setRange(1, 65535)
        self.tor_port_input.setValue(9050)
        proxy_check_layout.addWidget(self.proxy_check)
        proxy_check_layout.addWidget(self.tor_check)
        proxy_check_layout.addWidget(QLabel("Tor端口:"))
        proxy_check_layout.addWidget(self.tor_port_input)
        proxy_check_layout.addStretch()
        layout.addLayout(proxy_check_layout)
        
        return group
    
    def create_headers_group(self) -> QGroupBox:
        group = QGroupBox("HTTP头设置")
        layout = QVBoxLayout(group)
        
        headers_layout = QHBoxLayout()
        headers_layout.addWidget(QLabel("自定义Headers:"))
        self.headers_input = QLineEdit()
        self.headers_input.setPlaceholderText("Header1:Value1,Header2:Value2")
        headers_layout.addWidget(self.headers_input)
        layout.addLayout(headers_layout)
        
        ua_layout = QHBoxLayout()
        ua_layout.addWidget(QLabel("User-Agent:"))
        self.user_agent_input = QLineEdit()
        self.user_agent_input.setPlaceholderText("自定义User-Agent")
        ua_layout.addWidget(self.user_agent_input)
        layout.addLayout(ua_layout)
        
        referer_layout = QHBoxLayout()
        referer_layout.addWidget(QLabel("Referer:"))
        self.referer_input = QLineEdit()
        self.referer_input.setPlaceholderText("HTTP Referer头")
        referer_layout.addWidget(self.referer_input)
        layout.addLayout(referer_layout)
        
        ua_check_layout = QHBoxLayout()
        self.random_agent_check = QCheckBox("随机User-Agent")
        self.mobile_check = QCheckBox("模拟移动端")
        ua_check_layout.addWidget(self.random_agent_check)
        ua_check_layout.addWidget(self.mobile_check)
        ua_check_layout.addStretch()
        layout.addLayout(ua_check_layout)
        
        return group
    
    def create_tamper_group(self) -> QGroupBox:
        group = QGroupBox("Tamper脚本 (WAF绕过)")
        layout = QVBoxLayout(group)
        
        preset_layout = QHBoxLayout()
        preset_layout.addWidget(QLabel("预设组合:"))
        self.tamper_combo = QComboBox()
        self.tamper_combo.addItem("无", "")
        self.tamper_combo.addItem("基础绕过", "space2comment,charencode")
        self.tamper_combo.addItem("通用绕过", "space2comment,charencode,randomcase")
        self.tamper_combo.addItem("高级绕过", "space2comment,charencode,randomcase,between")
        self.tamper_combo.addItem("MySQL绕过", "space2mysqlblank,charencode,randomcase")
        self.tamper_combo.addItem("MSSQL绕过", "space2mssqlblank,between,charencode")
        self.tamper_combo.addItem("Oracle绕过", "space2hash,apostrophenullencode,equaltolike")
        self.tamper_combo.currentIndexChanged.connect(self.on_tamper_preset_changed)
        preset_layout.addWidget(self.tamper_combo)
        layout.addLayout(preset_layout)
        
        tamper_layout = QHBoxLayout()
        tamper_layout.addWidget(QLabel("脚本:"))
        self.tamper_input = QLineEdit()
        self.tamper_input.setPlaceholderText("脚本名称，多个用逗号分隔")
        tamper_layout.addWidget(self.tamper_input)
        select_btn = QPushButton("选择")
        select_btn.clicked.connect(self.select_tamper)
        tamper_layout.addWidget(select_btn)
        layout.addLayout(tamper_layout)
        
        return group
    
    def create_options_group(self) -> QGroupBox:
        group = QGroupBox("其他选项")
        layout = QVBoxLayout(group)
        
        row1 = QHBoxLayout()
        self.batch_check = QCheckBox("非交互模式")
        self.batch_check.setChecked(True)
        self.forms_check = QCheckBox("测试表单")
        self.crawl_check = QCheckBox("爬行网站")
        row1.addWidget(self.batch_check)
        row1.addWidget(self.forms_check)
        row1.addWidget(self.crawl_check)
        row1.addStretch()
        layout.addLayout(row1)
        
        row2 = QHBoxLayout()
        self.check_waf_check = QCheckBox("检测WAF")
        self.check_waf_check.setToolTip("检测WAF/IPS/IDS保护")
        self.skip_waf_check = QCheckBox("跳过WAF检测")
        self.skip_waf_check.setToolTip("跳过WAF/IPS/IDS保护检测")
        self.text_only_check = QCheckBox("仅文本分析")
        self.text_only_check.setChecked(True)
        row2.addWidget(self.check_waf_check)
        row2.addWidget(self.skip_waf_check)
        row2.addWidget(self.text_only_check)
        row2.addStretch()
        layout.addLayout(row2)
        
        row3 = QHBoxLayout()
        self.smart_check = QCheckBox("智能模式")
        self.ignore_500_check = QCheckBox("忽略500错误")
        self.ignore_500_check.setChecked(True)
        self.skip_urlencode_check = QCheckBox("跳过URL编码")
        row3.addWidget(self.smart_check)
        row3.addWidget(self.ignore_500_check)
        row3.addWidget(self.skip_urlencode_check)
        row3.addStretch()
        layout.addLayout(row3)
        
        row4 = QHBoxLayout()
        self.force_ssl_check = QCheckBox("强制SSL")
        self.keep_alive_check = QCheckBox("保持连接")
        self.keep_alive_check.setChecked(True)
        self.hex_check = QCheckBox("十六进制")
        row4.addWidget(self.force_ssl_check)
        row4.addWidget(self.keep_alive_check)
        row4.addWidget(self.hex_check)
        row4.addStretch()
        layout.addLayout(row4)
        
        row5 = QHBoxLayout()
        self.purge_check = QCheckBox("清除输出")
        self.flush_check = QCheckBox("刷新会话")
        self.all_check = QCheckBox("全部测试")
        self.beep_check = QCheckBox("发现时蜂鸣")
        row5.addWidget(self.purge_check)
        row5.addWidget(self.flush_check)
        row5.addWidget(self.all_check)
        row5.addWidget(self.beep_check)
        row5.addStretch()
        layout.addLayout(row5)
        
        row6 = QHBoxLayout()
        self.dependencies_check = QCheckBox("检查依赖")
        self.hpp_check = QCheckBox("HPP参数污染")
        self.hpp_check.setToolTip("HTTP参数污染攻击")
        row6.addWidget(self.dependencies_check)
        row6.addWidget(self.hpp_check)
        row6.addStretch()
        layout.addLayout(row6)
        
        return group
    
    def create_custom_group(self) -> QGroupBox:
        group = QGroupBox("自定义参数")
        layout = QVBoxLayout(group)
        
        self.custom_params = QTextEdit()
        self.custom_params.setPlaceholderText(
            "每行一个参数，例如:\n"
            "--level=3\n"
            "--risk=2\n"
            "--technique=BEUST"
        )
        self.custom_params.setMaximumHeight(100)
        layout.addWidget(self.custom_params)
        
        return group
    
    def create_command_tab(self) -> QWidget:
        tab = QWidget()
        layout = QVBoxLayout(tab)
        
        self.command_preview = QPlainTextEdit()
        self.command_preview.setReadOnly(True)
        self.command_preview.setPlaceholderText("点击'生成命令'查看将要执行的SQLMap命令")
        layout.addWidget(self.command_preview)
        
        btn_layout = QHBoxLayout()
        gen_btn = QPushButton("生成命令")
        gen_btn.clicked.connect(self.generate_command)
        copy_btn = QPushButton("复制命令")
        copy_btn.clicked.connect(self.copy_command)
        btn_layout.addWidget(gen_btn)
        btn_layout.addWidget(copy_btn)
        btn_layout.addStretch()
        layout.addLayout(btn_layout)
        
        return tab
    
    def create_right_panel(self) -> QWidget:
        panel = QWidget()
        layout = QVBoxLayout(panel)
        
        right_splitter = QSplitter(Qt.Vertical)
        
        output_group = QGroupBox("输出")
        output_layout = QVBoxLayout(output_group)
        
        self.output_text = QPlainTextEdit()
        self.output_text.setReadOnly(True)
        self.output_text.setFont(QFont("Consolas", 10))
        self.highlighter = SqlmapHighlighter(self.output_text.document())
        output_layout.addWidget(self.output_text)
        
        self.input_layout = QHBoxLayout()
        self.input_label = QLabel("输入:")
        self.input_line = QLineEdit()
        self.input_line.setPlaceholderText("输入命令 (用于os-shell/sql-shell交互)")
        self.input_line.returnPressed.connect(self.send_input)
        self.input_line.setEnabled(False)
        self.send_btn = QPushButton("发送")
        self.send_btn.clicked.connect(self.send_input)
        self.send_btn.setEnabled(False)
        self.input_layout.addWidget(self.input_label)
        self.input_layout.addWidget(self.input_line)
        self.input_layout.addWidget(self.send_btn)
        output_layout.addLayout(self.input_layout)
        
        right_splitter.addWidget(output_group)
        
        info_group = QGroupBox("提取信息")
        info_layout = QVBoxLayout(info_group)
        
        self.info_text = QPlainTextEdit()
        self.info_text.setReadOnly(True)
        self.info_text.setFont(QFont("Consolas", 9))
        self.info_text.setMaximumHeight(200)
        info_layout.addWidget(self.info_text)
        
        right_splitter.addWidget(info_group)
        right_splitter.setSizes([600, 200])
        
        layout.addWidget(right_splitter)
        return panel
    
    def select_file(self, line_edit: QLineEdit):
        file_path, _ = QFileDialog.getOpenFileName(self, "选择文件", "", "所有文件 (*)")
        if file_path:
            line_edit.setText(file_path)
    
    def select_request_file(self):
        self.select_file(self.request_file_input)
    
    def on_tamper_preset_changed(self, index):
        tamper_value = self.tamper_combo.currentData()
        if tamper_value:
            self.tamper_input.setText(tamper_value)
    
    def select_tamper(self):
        tamper_dir = APP_DIR / "tamper"
        if not tamper_dir.exists():
            QMessageBox.warning(self, "警告", f"找不到tamper目录: {tamper_dir}")
            return
        
        tamper_files = [f.stem for f in tamper_dir.glob("*.py") if f.name != "__init__.py"]
        
        dialog = QDialog(self)
        dialog.setWindowTitle("选择Tamper脚本")
        dialog.resize(700, 500)
        layout = QVBoxLayout(dialog)
        
        search_input = QLineEdit()
        search_input.setPlaceholderText("搜索...")
        layout.addWidget(search_input)
        
        table = QTableWidget()
        table.setColumnCount(3)
        table.setHorizontalHeaderLabels(["脚本名称", "描述", "选择"])
        table.horizontalHeader().setSectionResizeMode(0, QHeaderView.ResizeToContents)
        table.horizontalHeader().setSectionResizeMode(1, QHeaderView.Stretch)
        table.horizontalHeader().setSectionResizeMode(2, QHeaderView.ResizeToContents)
        table.setRowCount(len(tamper_files))
        
        for i, script in enumerate(sorted(tamper_files)):
            name_item = QTableWidgetItem(script)
            name_item.setFlags(name_item.flags() & ~Qt.ItemIsEditable)
            table.setItem(i, 0, name_item)
            
            desc = ""
            try:
                script_path = tamper_dir / f"{script}.py"
                content = script_path.read_text(encoding="utf-8", errors="ignore")
                match = re.search(r'"""(.*?)"""', content, re.DOTALL)
                if match:
                    desc = match.group(1).strip().split("\n")[0][:80]
            except:
                pass
            
            desc_item = QTableWidgetItem(desc)
            desc_item.setFlags(desc_item.flags() & ~Qt.ItemIsEditable)
            table.setItem(i, 1, desc_item)
            
            check_item = QTableWidgetItem()
            check_item.setFlags(Qt.ItemIsUserCheckable | Qt.ItemIsEnabled)
            check_item.setCheckState(Qt.Unchecked)
            table.setItem(i, 2, check_item)
        
        layout.addWidget(table)
        
        def filter_table():
            text = search_input.text().lower()
            for i in range(table.rowCount()):
                name = table.item(i, 0).text().lower()
                desc = table.item(i, 1).text().lower()
                table.setRowHidden(i, text not in name and text not in desc)
        
        search_input.textChanged.connect(filter_table)
        
        btn_layout = QHBoxLayout()
        ok_btn = QPushButton("确定")
        cancel_btn = QPushButton("取消")
        btn_layout.addStretch()
        btn_layout.addWidget(ok_btn)
        btn_layout.addWidget(cancel_btn)
        layout.addLayout(btn_layout)
        
        def on_ok():
            selected = []
            for i in range(table.rowCount()):
                if table.item(i, 2).checkState() == Qt.Checked:
                    selected.append(table.item(i, 0).text())
            self.tamper_input.setText(",".join(selected))
            dialog.accept()
        
        ok_btn.clicked.connect(on_ok)
        cancel_btn.clicked.connect(dialog.reject)
        dialog.exec_()
    
    def build_command(self) -> Optional[List[str]]:
        command = [sys.executable, str(APP_DIR / "sqlmap.py")]
        
        url = self.url_input.currentText().strip()
        request_file = self.request_file_input.text().strip()
        
        if not url and not request_file:
            QMessageBox.warning(self, "警告", "请输入目标URL或选择请求文件")
            return None
        
        if url:
            command.extend(["-u", url])
            self.add_recent_target(url)
        
        if request_file:
            command.extend(["-r", request_file])
        
        cookie = self.cookie_input.text().strip()
        if cookie:
            command.extend(["--cookie", cookie])
        
        post_data = self.post_data_input.text().strip()
        if post_data:
            command.extend(["--data", post_data])
        
        command.append(f"--level={self.level_buttons.checkedId()}")
        command.append(f"--risk={self.risk_buttons.checkedId()}")
        
        techniques = "".join(code for code, cb in self.technique_checkboxes.items() if cb.isChecked())
        if techniques and techniques != "BEUSTQ":
            command.append(f"--technique={techniques}")
        
        dbms = self.dbms_combo.currentData()
        if dbms:
            command.append(f"--dbms={dbms}")
        
        command.extend(self._build_enum_args())
        command.extend(self._build_os_args())
        command.extend(self._build_file_args())
        command.extend(self._build_registry_args())
        command.extend(self._build_injection_args())
        command.extend(self._build_advanced_args())
        
        if "--batch" not in command:
            command.append("--batch")
        
        if not any(arg.startswith("-v") or arg.startswith("--verbose") for arg in command):
            command.append("-v1")
        
        return command
    
    def _build_enum_args(self) -> List[str]:
        args = []
        
        if self.current_user_check.isChecked():
            args.append("--current-user")
        if self.current_db_check.isChecked():
            args.append("--current-db")
        if self.hostname_check.isChecked():
            args.append("--hostname")
        if self.is_dba_check.isChecked():
            args.append("--is-dba")
        if self.banner_check.isChecked():
            args.append("--banner")
        if self.comments_check.isChecked():
            args.append("--comments")
        if self.passwords_check.isChecked():
            args.append("--passwords")
        if self.privileges_check.isChecked():
            args.append("--privileges")
        if self.roles_check.isChecked():
            args.append("--roles")
        if self.users_check.isChecked():
            args.append("--users")
        if self.schema_check.isChecked():
            args.append("--schema")
        if self.dbs_check.isChecked():
            args.append("--dbs")
        if self.tables_check.isChecked():
            args.append("--tables")
        if self.columns_check.isChecked():
            args.append("--columns")
        if self.count_check.isChecked():
            args.append("--count")
        if self.dump_check.isChecked():
            args.append("--dump")
        if self.dump_all_check.isChecked():
            args.append("--dump-all")
        
        dump_format = self.dump_format_combo.currentText()
        if dump_format != "CSV":
            args.append(f"--dump-format={dump_format}")
        
        db = self.db_input.text().strip()
        if db:
            args.extend(["-D", db])
        
        table = self.table_input.text().strip()
        if table:
            args.extend(["-T", table])
        
        column = self.column_input.text().strip()
        if column:
            args.extend(["-C", column])
        
        where = self.where_input.text().strip()
        if where:
            args.extend(["--where", where])
        
        start = self.start_input.value()
        if start > 0:
            args.append(f"--start={start}")
        
        stop = self.stop_input.value()
        if stop > 0:
            args.append(f"--stop={stop}")
        
        return args
    
    def _build_os_args(self) -> List[str]:
        args = []
        
        if self.os_shell_check.isChecked():
            args.append("--os-shell")
            self.interactive_mode = True
        
        if self.sql_shell_check.isChecked():
            args.append("--sql-shell")
            self.interactive_mode = True
        
        if self.os_cmd_check.isChecked() and self.os_cmd_input.text().strip():
            args.extend(["--os-cmd", self.os_cmd_input.text().strip()])
        
        if self.os_pwn_check.isChecked():
            args.append("--os-pwn")
        
        if self.os_smbrelay_check.isChecked():
            args.append("--os-smbrelay")
        
        if self.priv_esc_check.isChecked():
            args.append("--priv-esc")
        
        exec_func = self.exec_func_combo.currentText()
        if exec_func != "自动选择":
            args.append(f"--exec-func={exec_func}")
        
        shell_type = self.os_shell_type_combo.currentText()
        if shell_type != "自动":
            args.append(f"--os-shell-type={shell_type}")
        
        msf_path = self.msf_path_input.text().strip()
        if msf_path:
            args.extend(["--msf-path", msf_path])
        
        tmp_path = self.tmp_path_input.text().strip()
        if tmp_path:
            args.extend(["--tmp-path", tmp_path])
        
        os_type = self.os_combo.currentText()
        if os_type != "自动检测":
            args.append(f"--os={os_type}")
        
        return args
    
    def _build_file_args(self) -> List[str]:
        args = []
        
        if self.file_read_check.isChecked() and self.file_read_input.text().strip():
            args.extend(["--file-read", self.file_read_input.text().strip()])
        
        if self.file_write_check.isChecked():
            local = self.file_write_local_input.text().strip()
            dest = self.file_write_dest_input.text().strip()
            if local and dest:
                args.extend(["--file-write", local])
                args.extend(["--file-dest", dest])
        
        if self.web_file_check.isChecked():
            args.append("--web-file")
            if self.web_root_input.text().strip():
                args.extend(["--web-root", self.web_root_input.text().strip()])
        
        if self.upload_check.isChecked() and self.upload_url_input.text().strip():
            args.extend(["--upload", self.upload_url_input.text().strip()])
        
        return args
    
    def _build_registry_args(self) -> List[str]:
        args = []
        
        key = self.reg_key_input.text().strip()
        val = self.reg_val_input.text().strip()
        
        if self.reg_read_check.isChecked() and key:
            args.append("--reg-read")
            args.extend(["--reg-key", key])
            if val:
                args.extend(["--reg-val", val])
        
        if self.reg_add_check.isChecked() and key:
            args.append("--reg-add")
            args.extend(["--reg-key", key])
            if val:
                args.extend(["--reg-val", val])
            data = self.reg_data_input.text().strip()
            if data:
                args.extend(["--reg-data", data])
            reg_type = self.reg_type_combo.currentText()
            args.extend(["--reg-type", reg_type])
        
        if self.reg_del_check.isChecked() and key:
            args.append("--reg-del")
            args.extend(["--reg-key", key])
            if val:
                args.extend(["--reg-val", val])
        
        return args
    
    def _build_injection_args(self) -> List[str]:
        args = []
        
        prefix = self.prefix_input.text().strip()
        if prefix:
            args.extend(["--prefix", prefix])
        
        suffix = self.suffix_input.text().strip()
        if suffix:
            args.extend(["--suffix", suffix])
        
        test_filter = self.test_filter_input.text().strip()
        if test_filter:
            args.extend(["--test-filter", test_filter])
        
        test_skip = self.test_skip_input.text().strip()
        if test_skip:
            args.extend(["--test-skip", test_skip])
        
        param_del = self.param_del_input.text().strip()
        if param_del:
            args.extend(["--param-del", param_del])
        
        cookie_del = self.cookie_del_input.text().strip()
        if cookie_del:
            args.extend(["--cookie-del", cookie_del])
        
        if self.skip_static_check.isChecked():
            args.append("--skip-static")
        
        auth_type = self.auth_type_combo.currentText()
        if auth_type != "无":
            args.append(f"--auth-type={auth_type}")
            user = self.auth_user_input.text().strip()
            if user:
                args.extend(["--auth-cred", f"{user}:{self.auth_pass_input.text()}"])
        
        dbms_user = self.dbms_user_input.text().strip()
        if dbms_user:
            cred = f"{dbms_user}:{self.dbms_pass_input.text()}"
            args.extend(["--dbms-cred", cred])
        
        if self.second_order_check.isChecked() and self.second_order_input.text().strip():
            args.extend(["--second-order", self.second_order_input.text().strip()])
        
        dns_domain = self.dns_domain_input.text().strip()
        if dns_domain:
            args.extend(["--dns-domain", dns_domain])
        
        if self.safe_req_check.isChecked():
            safe_url = self.safe_url_input.text().strip()
            if safe_url:
                args.extend(["--safe-url", safe_url])
                if self.safe_freq_input.value() > 0:
                    args.append(f"--safe-freq={self.safe_freq_input.value()}")
        
        if self.direct_check.isChecked():
            direct_conn = self.direct_conn_input.text().strip()
            if direct_conn:
                args.extend(["--direct", direct_conn])
        
        return args
    
    def _build_advanced_args(self) -> List[str]:
        args = []
        
        threads = self.threads_spin.value()
        if threads > 1:
            args.append(f"--threads={threads}")
        
        args.append(f"--timeout={self.timeout_spin.value()}")
        
        delay = self.delay_spin.value()
        if delay > 0:
            args.append(f"--delay={delay}")
        
        retries = self.retries_spin.value()
        if retries != 3:
            args.append(f"--retries={retries}")
        
        if self.proxy_check.isChecked() and self.proxy_input.text().strip():
            args.extend(["--proxy", self.proxy_input.text().strip()])
            proxy_user = self.proxy_user_input.text().strip()
            if proxy_user:
                cred = f"{proxy_user}:{self.proxy_pass_input.text()}"
                args.extend(["--proxy-cred", cred])
        
        if self.tor_check.isChecked():
            args.append("--tor")
            args.append(f"--tor-port={self.tor_port_input.value()}")
        
        headers = self.headers_input.text().strip()
        if headers:
            args.extend(["--headers", headers])
        
        user_agent = self.user_agent_input.text().strip()
        if user_agent:
            args.extend(["--user-agent", user_agent])
        
        referer = self.referer_input.text().strip()
        if referer:
            args.extend(["--referer", referer])
        
        if self.random_agent_check.isChecked():
            args.append("--random-agent")
        
        if self.mobile_check.isChecked():
            args.append("--mobile")
        
        tamper = self.tamper_input.text().strip()
        if tamper:
            args.append(f"--tamper={tamper}")
        
        if self.batch_check.isChecked():
            args.append("--batch")
        
        if self.forms_check.isChecked():
            args.append("--forms")
        
        if self.crawl_check.isChecked():
            args.append("--crawl=2")
        
        if self.check_waf_check.isChecked():
            args.append("--check-waf")
        
        if self.text_only_check.isChecked():
            args.append("--text-only")
        
        if self.smart_check.isChecked():
            args.append("--smart")
        
        if self.ignore_500_check.isChecked():
            args.append("--ignore-code=500")
        
        if self.skip_urlencode_check.isChecked():
            args.append("--skip-urlencode")
        
        if self.force_ssl_check.isChecked():
            args.append("--force-ssl")
        
        if self.keep_alive_check.isChecked():
            args.append("--keep-alive")
        
        if self.hex_check.isChecked():
            args.append("--hex")
        
        if self.purge_check.isChecked():
            args.append("--purge")
        
        if self.flush_check.isChecked():
            args.append("--flush-session")
        
        if self.all_check.isChecked():
            args.append("--all")
        
        if self.beep_check.isChecked():
            args.append("--beep")
        
        if self.dependencies_check.isChecked():
            args.append("--dependencies")
        
        if self.hpp_check.isChecked():
            args.append("--hpp")
        
        if self.skip_waf_check.isChecked():
            args.append("--skip-waf")
        
        custom = self.custom_params.toPlainText().strip()
        if custom:
            for line in custom.split("\n"):
                line = line.strip()
                if line and not line.startswith("#"):
                    args.append(line)
        
        return args
    
    def generate_command(self):
        command = self.build_command()
        if command:
            self.command_preview.setPlainText(" ".join(command))
    
    def copy_command(self):
        command = self.build_command()
        if command:
            QApplication.clipboard().setText(" ".join(command))
            self.statusBar.showMessage("命令已复制到剪贴板")
    
    def start_scan(self):
        if self.scanning:
            return
        
        self.interactive_mode = self.os_shell_check.isChecked() or self.sql_shell_check.isChecked()
        
        command = self.build_command()
        if not command:
            return
        
        self.scanning = True
        self.start_button.setEnabled(False)
        self.start_action.setEnabled(False)
        self.stop_button.setEnabled(True)
        self.stop_action.setEnabled(True)
        self.progress_bar.setFormat("初始化...")
        self.progress_bar.setValue(0)
        self.statusBar.showMessage("正在初始化扫描...")
        
        self.new_log_file()
        self.output_text.clear()
        self.info_text.clear()
        self._extracting_dbs = False
        
        self.extracted_info = {
            "target": self.url_input.currentText().strip() or self.request_file_input.text().strip(),
            "dbms": "",
            "dbms_version": "",
            "banner": "",
            "os": "",
            "web_server": "",
            "current_user": "",
            "current_db": "",
            "hostname": "",
            "is_dba": "",
            "injection_points": [],
            "databases": [],
            "tables": [],
            "columns": [],
            "users": [],
            "passwords": [],
        }
        
        timestamp = datetime.now().strftime("[%Y-%m-%d %H:%M:%S] ")
        self.output_text.appendPlainText(f"{timestamp}[信息] 开始扫描: {' '.join(command)}")
        self.output_text.appendPlainText(f"{timestamp}[信息] 目标: {self.url_input.currentText().strip() or self.request_file_input.text().strip()}")
        self.output_text.appendPlainText(f"{timestamp}[信息] 检测级别: {self.level_buttons.checkedId()}, 风险级别: {self.risk_buttons.checkedId()}")
        self.output_text.moveCursor(QTextCursor.End)
        
        if self.current_log_file:
            with open(self.current_log_file, "a", encoding="utf-8") as f:
                f.write(f"{timestamp}[信息] 开始扫描: {' '.join(command)}\n")
                f.write(f"{timestamp}[信息] 目标: {self.url_input.currentText().strip() or self.request_file_input.text().strip()}\n")
                f.write(f"{timestamp}[信息] 检测级别: {self.level_buttons.checkedId()}, 风险级别: {self.risk_buttons.checkedId()}\n")
        
        if self.interactive_mode:
            self.input_line.setEnabled(True)
            self.send_btn.setEnabled(True)
            self.interactive_thread.set_command(command)
            self.interactive_thread.start()
        else:
            self.input_line.setEnabled(False)
            self.send_btn.setEnabled(False)
            self.command_thread.set_command(command)
            self.command_thread.start()
    
    def stop_scan(self):
        if not self.scanning:
            return
        
        self.command_thread.stop()
        self.interactive_thread.stop()
        
        self.scanning = False
        self.start_button.setEnabled(True)
        self.start_action.setEnabled(True)
        self.stop_button.setEnabled(False)
        self.stop_action.setEnabled(False)
        self.progress_bar.setFormat("已停止")
        self.progress_bar.setValue(0)
        self.statusBar.showMessage("扫描已停止")
        
        self.input_line.setEnabled(False)
        self.send_btn.setEnabled(False)
        
        self.update_output("[信息] 扫描已被用户停止")
    
    def send_input(self):
        text = self.input_line.text().strip()
        if text and self.interactive_thread.isRunning():
            self.interactive_thread.send_input(text)
            self.update_output(f"> {text}")
            self.input_line.clear()
    
    def update_output(self, text: str):
        if not text:
            return
        
        timestamp = datetime.now().strftime("[%Y-%m-%d %H:%M:%S] ")
        text = Translations.translate(text)
        
        replacements = [
            ("[INFO]", "[信息]"), ("[ERROR]", "[错误]"),
            ("[WARNING]", "[警告]"), ("[DEBUG]", "[调试]"),
            ("[CRITICAL]", "[严重]"), ("[PAYLOAD]", "[载荷]"),
        ]
        for old, new in replacements:
            text = text.replace(old, new)
        
        if any(tag in text for tag in ["[信息]", "[错误]", "[警告]", "[调试]", "[严重]", "[载荷]", "[发现]"]):
            formatted = f"{timestamp}{text}"
        else:
            formatted = f"{timestamp}[详细] {text}"
        
        self.output_text.appendPlainText(formatted)
        
        doc = self.output_text.document()
        if doc.blockCount() > 10000:
            cursor = QTextCursor(doc)
            cursor.movePosition(QTextCursor.Start)
            cursor.movePosition(QTextCursor.Down, QTextCursor.KeepAnchor, 1000)
            cursor.removeSelectedText()
        self.output_text.moveCursor(QTextCursor.End)
        
        if self.current_log_file:
            self._log_buffer.append(formatted)
            if len(self._log_buffer) >= 50:
                self._flush_log_buffer()
        
        self.update_progress(text)
        self.extract_info(text)
    
    def _flush_log_buffer(self):
        if self._log_buffer and self.current_log_file:
            try:
                with open(self.current_log_file, "a", encoding="utf-8") as f:
                    f.write("\n".join(self._log_buffer) + "\n")
                self._log_buffer.clear()
            except Exception:
                pass
    
    def update_progress(self, text: str):
        if not self.scanning:
            return
        
        progress_stages = [
            ("testing connection", 5, "测试连接"),
            ("checking if the target is protected", 8, "检测WAF"),
            ("testing if the target URL content is stable", 10, "稳定性测试"),
            ("heuristic test", 12, "启发式测试"),
            ("testing for SQL injection", 15, "SQL注入测试"),
            ("parameter.*appears to be injectable", 25, "发现可注入参数"),
            ("parameter.*is vulnerable", 30, "确认漏洞"),
            ("injectable", 30, "可注入"),
            ("the back-end DBMS is", 35, "识别DBMS"),
            ("identified.*MySQL|identified.*Oracle|identified.*PostgreSQL|identified.*Microsoft", 40, "确认数据库类型"),
            ("fetching.*current user", 45, "获取当前用户"),
            ("fetching.*current database", 50, "获取当前数据库"),
            ("fetching.*hostname", 52, "获取主机名"),
            ("fetching.*database management system users", 55, "获取用户列表"),
            ("fetching.*password", 58, "获取密码哈希"),
            ("fetching.*privilege", 60, "获取权限"),
            ("fetching.*databases", 65, "获取数据库列表"),
            ("fetching.*tables", 70, "获取表列表"),
            ("fetching.*columns", 75, "获取列列表"),
            ("fetching.*entries", 80, "获取数据"),
            ("dumping", 85, "导出数据"),
            ("dumped", 90, "数据导出"),
            ("reading file", 70, "读取文件"),
            ("writing file", 70, "写入文件"),
            ("os-shell", 60, "OS Shell"),
            ("sql-shell", 60, "SQL Shell"),
            ("executing.*command", 65, "执行命令"),
            ("starting", 3, "开始"),
        ]
        
        text_lower = text.lower()
        current_progress = self.progress_bar.value()
        
        for pattern, progress, stage_name in progress_stages:
            if re.search(pattern, text_lower):
                if progress > current_progress:
                    self.progress_bar.setValue(progress)
                    self.progress_bar.setFormat(f"{stage_name}... {progress}%")
                    self.statusBar.showMessage(f"{stage_name}...")
                    break
        
        if current_progress < 95:
            if random.random() < 0.1:
                small_increment = min(2, 95 - current_progress)
                if small_increment > 0:
                    self.progress_bar.setValue(current_progress + small_increment)
    
    def extract_info(self, text: str):
        try:
            self._do_extract_info(text)
        except Exception:
            pass
    
    def _do_extract_info(self, text: str):
        text_lower = text.lower()
        
        if "parameter:" in text_lower and "(" in text:
            match = re.search(r"Parameter:\s*(\S+)", text, re.IGNORECASE)
            if match:
                param = match.group(1)
                if param not in [p["parameter"] for p in self.extracted_info["injection_points"]]:
                    self.extracted_info["injection_points"].append({"parameter": param, "types": []})
        
        if "type:" in text_lower:
            match = re.search(r"Type:\s*(.+?)(?:\n|$)", text, re.IGNORECASE)
            if match and self.extracted_info["injection_points"]:
                inj_type = match.group(1).strip()
                if inj_type not in self.extracted_info["injection_points"][-1]["types"]:
                    self.extracted_info["injection_points"][-1]["types"].append(inj_type)
        
        if "title:" in text_lower:
            match = re.search(r"Title:\s*(.+?)(?:\n|$)", text, re.IGNORECASE)
            if match and self.extracted_info["injection_points"]:
                title = match.group(1).strip()
                self.extracted_info["injection_points"][-1]["title"] = title
        
        if "payload:" in text_lower:
            match = re.search(r"Payload:\s*(.+?)(?:\n|$)", text, re.IGNORECASE)
            if match and self.extracted_info["injection_points"]:
                payload = match.group(1).strip()
                self.extracted_info["injection_points"][-1]["payload"] = payload
        
        if "mysql" in text_lower and ">=" in text:
            match = re.search(r"MySQL\s*>=\s*([\d.]+)", text, re.IGNORECASE)
            if match:
                self.extracted_info["dbms"] = "MySQL"
                self.extracted_info["dbms_version"] = f">= {match.group(1)}"
        
        if "后端dbms" in text or "back-end dbms" in text_lower:
            match = re.search(r"(?:后端DBMS|back-end DBMS)[:\s]+(\w+)", text, re.IGNORECASE)
            if match:
                self.extracted_info["dbms"] = match.group(1).capitalize()
        
        os_patterns = [
            r"web server 操作系统[:\s]+(.+?)(?:\n|$)",
            r"web server operating system[:\s]+(.+?)(?:\n|$)",
        ]
        for pattern in os_patterns:
            match = re.search(pattern, text, re.IGNORECASE)
            if match:
                self.extracted_info["os"] = match.group(1).strip()
                break
        
        web_patterns = [
            r"Web应用技术[:\s]+(.+?)(?:\n|$)",
            r"web application technology[:\s]+(.+?)(?:\n|$)",
        ]
        for pattern in web_patterns:
            match = re.search(pattern, text, re.IGNORECASE)
            if match:
                self.extracted_info["web_server"] = match.group(1).strip()
                break
        
        user_patterns = [
            r"当前用户[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
            r"current user[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
        ]
        for pattern in user_patterns:
            match = re.search(pattern, text, re.IGNORECASE)
            if match:
                self.extracted_info["current_user"] = match.group(1).strip("'\" ")
                break
        
        db_patterns = [
            r"当前数据库[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
            r"current database[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
        ]
        for pattern in db_patterns:
            match = re.search(pattern, text, re.IGNORECASE)
            if match:
                self.extracted_info["current_db"] = match.group(1).strip("'\" ")
                break
        
        hostname_patterns = [
            r"主机名[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
            r"hostname[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
        ]
        for pattern in hostname_patterns:
            match = re.search(pattern, text, re.IGNORECASE)
            if match:
                self.extracted_info["hostname"] = match.group(1).strip("'\" ")
                break
        
        banner_patterns = [
            r"banner[:\s]+['\"]?([^'\"\n]+?)['\"]?(?:\s|$|\n)",
            r"banner:\s*'([^']+)'",
            r"(\d+\.\d+\.\d+[^\s'\"]*)",
        ]
        for pattern in banner_patterns:
            match = re.search(pattern, text, re.IGNORECASE)
            if match:
                banner_value = match.group(1).strip("'\" ")
                if banner_value and len(banner_value) > 2:
                    self.extracted_info["banner"] = banner_value
                    break
        
        if "is dba" in text_lower or "是dba" in text:
            if "true" in text_lower:
                self.extracted_info["is_dba"] = "是"
            elif "false" in text_lower:
                self.extracted_info["is_dba"] = "否"
        
        if "available databases" in text_lower or "可用数据库" in text:
            self._extracting_dbs = True
            self._extracting_tables = False
            self._extracting_columns = False
        
        if "[*]" in text and self._extracting_dbs:
            dbs = re.findall(r"\[\*\]\s*(\S+)", text)
            if dbs:
                for db in dbs:
                    if db not in self.extracted_info["databases"]:
                        self.extracted_info["databases"].append(db)
        
        if "Database:" in text and "Table:" not in text:
            match = re.search(r"Database:\s*(\S+)", text)
            if match:
                db = match.group(1)
                if db not in self.extracted_info["databases"]:
                    self.extracted_info["databases"].append(db)
        
        if "available tables" in text_lower or "可用表" in text:
            self._extracting_dbs = False
            self._extracting_tables = True
            self._extracting_columns = False
            match = re.search(r"(?:Database|数据库):\s*(\S+)", text)
            if match:
                self._current_db_for_tables = match.group(1)
        
        if "[*]" in text and self._extracting_tables:
            tables = re.findall(r"\[\*\]\s*(\S+)", text)
            if tables:
                for tbl in tables:
                    if tbl not in self.extracted_info["tables"]:
                        self.extracted_info["tables"].append(tbl)
        
        if "available columns" in text_lower or "可用列" in text:
            self._extracting_dbs = False
            self._extracting_tables = False
            self._extracting_columns = True
        
        if "[*]" in text and self._extracting_columns:
            columns = re.findall(r"\[\*\]\s*(\S+)", text)
            if columns:
                for col in columns:
                    if col not in self.extracted_info["columns"]:
                        self.extracted_info["columns"].append(col)
        
        if "database management system users" in text_lower or "数据库管理系统用户" in text:
            self._extracting_users = True
        
        if "[*]" in text and self._extracting_users:
            users = re.findall(r"\[\*\]\s*(\S+)", text)
            if users:
                for user in users:
                    if user not in self.extracted_info["users"]:
                        self.extracted_info["users"].append(user)
        
        if "starting" in text_lower and ("target url" in text_lower or "目标url" in text.lower()):
            match = re.search(r"(?:target URL|目标URL)[:\s]+(\S+)", text, re.IGNORECASE)
            if match:
                self.extracted_info["target"] = match.group(1).strip("'\"")
        
        self._info_dirty = True
    
    def _update_info_if_dirty(self):
        if self._info_dirty:
            self._info_dirty = False
            self.update_info_display()
    
    def update_info_display(self):
        info_lines = []
        
        if self.extracted_info["target"]:
            info_lines.append(f"[目标] {self.extracted_info['target']}")
        
        if self.extracted_info["dbms"]:
            version = f" {self.extracted_info['dbms_version']}" if self.extracted_info["dbms_version"] else ""
            info_lines.append(f"[数据库] {self.extracted_info['dbms']}{version}")
        
        if self.extracted_info["banner"]:
            info_lines.append(f"[Banner] {self.extracted_info['banner']}")
        
        if self.extracted_info["os"]:
            info_lines.append(f"[操作系统] {self.extracted_info['os']}")
        
        if self.extracted_info["web_server"]:
            info_lines.append(f"[Web服务器] {self.extracted_info['web_server']}")
        
        if self.extracted_info["current_user"]:
            dba = f" (DBA: {self.extracted_info['is_dba']})" if self.extracted_info["is_dba"] else ""
            info_lines.append(f"[当前用户] {self.extracted_info['current_user']}{dba}")
        
        if self.extracted_info["current_db"]:
            info_lines.append(f"[当前数据库] {self.extracted_info['current_db']}")
        
        if self.extracted_info["hostname"]:
            info_lines.append(f"[主机名] {self.extracted_info['hostname']}")
        
        if self.extracted_info["injection_points"]:
            info_lines.append("\n[注入点]")
            for inj in self.extracted_info["injection_points"]:
                types = ", ".join(inj.get("types", []))
                info_lines.append(f"  参数: {inj['parameter']}")
                if types:
                    info_lines.append(f"    类型: {types}")
                if inj.get("title"):
                    info_lines.append(f"    标题: {inj['title']}")
        
        if self.extracted_info["databases"]:
            info_lines.append(f"\n[数据库列表] {', '.join(self.extracted_info['databases'][:10])}")
            if len(self.extracted_info["databases"]) > 10:
                info_lines.append(f"  ... 共 {len(self.extracted_info['databases'])} 个")
        
        if self.extracted_info["tables"]:
            info_lines.append(f"\n[表列表] {', '.join(self.extracted_info['tables'][:15])}")
            if len(self.extracted_info["tables"]) > 15:
                info_lines.append(f"  ... 共 {len(self.extracted_info['tables'])} 个")
        
        if self.extracted_info["columns"]:
            info_lines.append(f"\n[列列表] {', '.join(self.extracted_info['columns'][:15])}")
            if len(self.extracted_info['columns']) > 15:
                info_lines.append(f"  ... 共 {len(self.extracted_info['columns'])} 个")
        
        if self.extracted_info["users"]:
            info_lines.append(f"\n[用户列表] {', '.join(self.extracted_info['users'][:10])}")
            if len(self.extracted_info["users"]) > 10:
                info_lines.append(f"  ... 共 {len(self.extracted_info['users'])} 个")
        
        if info_lines:
            self.info_text.setPlainText("\n".join(info_lines))
    
    def on_command_finished(self, return_code: int):
        self.scanning = False
        self._extracting_dbs = False
        self._extracting_tables = False
        self._extracting_columns = False
        self._extracting_users = False
        self.start_button.setEnabled(True)
        self.start_action.setEnabled(True)
        self.stop_button.setEnabled(False)
        self.stop_action.setEnabled(False)
        
        self.input_line.setEnabled(False)
        self.send_btn.setEnabled(False)
        
        if return_code == 0:
            self.progress_bar.setFormat("扫描完成")
            self.progress_bar.setValue(100)
            self.statusBar.showMessage("扫描完成")
            self.update_output("[信息] 扫描完成")
        else:
            self.progress_bar.setFormat(f"扫描结束 (返回码: {return_code})")
            self.progress_bar.setValue(0)
            self.statusBar.showMessage(f"扫描结束 (返回码: {return_code})")
            self.update_output(f"[信息] 扫描结束，返回码: {return_code}")
        
        self.update_output(f"[信息] 日志已保存: {self.current_log_file}")
    
    def new_log_file(self):
        timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
        self.current_log_file = LOGS_DIR / f"sqlmap_scan_{timestamp}.log"
    
    def add_recent_target(self, target: str):
        if not target:
            return
        
        if target in self.recent_targets:
            self.recent_targets.remove(target)
        
        self.recent_targets.insert(0, target)
        self.recent_targets = self.recent_targets[:20]
        self.save_config()
    
    def load_config(self):
        try:
            if CONFIG_FILE.exists():
                config = json.loads(CONFIG_FILE.read_text(encoding="utf-8"))
                self.recent_targets = config.get("recent_targets", [])
        except Exception:
            self.recent_targets = []
    
    def save_config(self):
        try:
            CONFIG_FILE.parent.mkdir(exist_ok=True)
            config = {"recent_targets": self.recent_targets[:20]}
            CONFIG_FILE.write_text(json.dumps(config, ensure_ascii=False, indent=2), encoding="utf-8")
        except Exception as e:
            print(f"保存配置失败: {e}")
    
    def generate_report(self):
        if not self.current_log_file or not self.current_log_file.exists():
            QMessageBox.warning(self, "警告", "没有可用的扫描日志")
            return
        
        try:
            log_content = self.current_log_file.read_text(encoding="utf-8")
            
            has_vuln = any(kw in log_content for kw in ["is vulnerable", "可注入", "脆弱的", "injectable"])
            
            report = f"""<!DOCTYPE html>
<html lang="zh-CN">
<head>
<meta charset="UTF-8">
<title>SQLMap扫描报告</title>
<style>
body {{ font-family: Arial, sans-serif; margin: 20px; }}
h1 {{ color: #2c3e50; border-bottom: 2px solid #3498db; padding-bottom: 10px; }}
.vuln {{ background: #f8d7da; border-left: 5px solid #dc3545; padding: 15px; margin: 10px 0; }}
.safe {{ background: #d4edda; border-left: 5px solid #28a745; padding: 15px; margin: 10px 0; }}
.log {{ background: #f8f9fa; padding: 15px; font-family: monospace; white-space: pre-wrap; max-height: 500px; overflow-y: auto; }}
</style>
</head>
<body>
<h1>SQLMap 扫描报告</h1>
<p>生成时间: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}</p>
<p>日志文件: {self.current_log_file}</p>

<div class="{'vuln' if has_vuln else 'safe'}">
<h2>{'⚠️ 发现SQL注入漏洞' if has_vuln else '✅ 未发现SQL注入漏洞'}</h2>
</div>

<h2>详细日志</h2>
<div class="log">{log_content.replace('<', '&lt;').replace('>', '&gt;')}</div>

<h2>修复建议</h2>
<ol>
<li>使用参数化查询，避免SQL拼接</li>
<li>对所有用户输入进行严格验证</li>
<li>限制数据库用户权限</li>
<li>部署WAF进行防护</li>
</ol>
</body>
</html>"""
            
            report_file = LOGS_DIR / f"report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.html"
            report_file.write_text(report, encoding="utf-8")
            
            QMessageBox.information(self, "成功", f"报告已生成:\n{report_file}")
            
        except Exception as e:
            QMessageBox.critical(self, "错误", f"生成报告失败: {e}")
    
    def show_history(self):
        log_files = sorted(LOGS_DIR.glob("sqlmap_scan_*.log"), reverse=True)
        
        if not log_files:
            QMessageBox.information(self, "历史记录", "没有历史扫描记录")
            return
        
        dialog = QDialog(self)
        dialog.setWindowTitle("扫描历史记录")
        dialog.resize(800, 500)
        layout = QVBoxLayout(dialog)
        
        table = QTableWidget()
        table.setColumnCount(3)
        table.setHorizontalHeaderLabels(["时间", "目标", "操作"])
        table.horizontalHeader().setSectionResizeMode(0, QHeaderView.ResizeToContents)
        table.horizontalHeader().setSectionResizeMode(1, QHeaderView.Stretch)
        table.horizontalHeader().setSectionResizeMode(2, QHeaderView.ResizeToContents)
        table.setRowCount(len(log_files))
        
        for i, log_file in enumerate(log_files[:50]):
            try:
                ts = log_file.stem.replace("sqlmap_scan_", "")
                time_str = f"{ts[:4]}-{ts[4:6]}-{ts[6:8]} {ts[9:11]}:{ts[11:13]}:{ts[13:15]}"
            except:
                time_str = log_file.name
            
            table.setItem(i, 0, QTableWidgetItem(time_str))
            
            target = "未知"
            try:
                content = log_file.read_text(encoding="utf-8")
                for line in content.split("\n"):
                    if "目标:" in line or "目标URL:" in line:
                        target = line.split(":", 1)[-1].strip()
                        break
            except:
                pass
            table.setItem(i, 1, QTableWidgetItem(target))
            
            view_btn = QPushButton("查看")
            view_btn.clicked.connect(lambda checked, f=log_file: self.view_log(f))
            table.setCellWidget(i, 2, view_btn)
        
        layout.addWidget(table)
        
        close_btn = QPushButton("关闭")
        close_btn.clicked.connect(dialog.accept)
        layout.addWidget(close_btn)
        
        dialog.exec_()
    
    def view_log(self, log_file: Path):
        try:
            content = log_file.read_text(encoding="utf-8")
            
            dialog = QDialog(self)
            dialog.setWindowTitle(f"日志: {log_file.name}")
            dialog.resize(900, 600)
            layout = QVBoxLayout(dialog)
            
            text = QPlainTextEdit()
            text.setReadOnly(True)
            text.setPlainText(content)
            SqlmapHighlighter(text.document())
            layout.addWidget(text)
            
            close_btn = QPushButton("关闭")
            close_btn.clicked.connect(dialog.accept)
            layout.addWidget(close_btn)
            
            dialog.exec_()
        except Exception as e:
            QMessageBox.critical(self, "错误", f"读取日志失败: {e}")
    
    def show_help(self):
        help_text = """<h2>SQLMap 中文图形化界面使用帮助</h2>

<h3>基本使用</h3>
<ol>
<li>在"基本设置"中输入目标URL或选择请求文件</li>
<li>设置检测级别和风险级别</li>
<li>选择需要的注入技术和枚举选项</li>
<li>点击"开始扫描"</li>
</ol>

<h3>系统访问功能</h3>
<ul>
<li><b>os-shell</b>: 获取交互式操作系统Shell</li>
<li><b>sql-shell</b>: 获取交互式SQL Shell</li>
<li><b>os-cmd</b>: 执行单个系统命令</li>
<li><b>os-pwn</b>: 获取Meterpreter/VNC会话</li>
<li><b>os-smbrelay</b>: SMB中继攻击</li>
<li><b>priv-esc</b>: 尝试权限提升</li>
</ul>

<h3>文件操作</h3>
<ul>
<li><b>file-read</b>: 读取服务器文件</li>
<li><b>file-write</b>: 写入文件到服务器</li>
<li><b>web-file</b>: 检测Web文件</li>
</ul>

<h3>注册表操作 (仅Windows)</h3>
<ul>
<li><b>reg-read</b>: 读取注册表</li>
<li><b>reg-add</b>: 添加注册表项</li>
<li><b>reg-del</b>: 删除注册表项</li>
</ul>

<h3>高级注入选项</h3>
<ul>
<li><b>二阶注入</b>: 在不同页面触发和显示注入结果</li>
<li><b>DNS泄露</b>: 通过DNS通道外带数据</li>
<li><b>安全URL</b>: 保持会话活跃</li>
<li><b>直接连接</b>: 直接连接数据库而非注入</li>
</ul>

<h3>高级利用选项</h3>
<ul>
<li><b>HPP参数污染</b>: HTTP参数污染攻击</li>
<li><b>WAF识别</b>: 识别目标使用的WAF类型</li>
<li><b>Metasploit集成</b>: 配合MSF进行渗透</li>
</ul>

<h3>参数说明</h3>
<ul>
<li><b>检测级别(1-5)</b>: 级别越高检测越全面</li>
<li><b>风险级别(1-3)</b>: 级别越高风险越大</li>
<li><b>注入技术</b>: B-布尔盲注, E-报错注入, U-联合查询, S-堆叠查询, T-时间盲注, Q-内联查询</li>
</ul>

<h3>常用技巧</h3>
<ul>
<li>遇到WAF时，尝试使用Tamper脚本绕过</li>
<li>目标响应慢时，增加超时时间</li>
<li>需要更全面的检测时，提高检测级别</li>
<li>使用代理可以配合Burp Suite等工具</li>
<li>os-shell需要堆叠查询或特定权限</li>
<li>DNS泄露需要控制域名的DNS服务器</li>
</ul>
"""
        QMessageBox.information(self, "帮助", help_text)
    
    def show_contact_dialog(self):
        dialog = ContactDialog(self)
        dialog.exec_()
    
    def closeEvent(self, event):
        if self.scanning:
            reply = QMessageBox.question(
                self, "确认退出",
                "扫描正在进行中，确定要退出吗？",
                QMessageBox.Yes | QMessageBox.No,
                QMessageBox.No
            )
            if reply == QMessageBox.No:
                event.ignore()
                return
            
            self.command_thread.stop()
            self.interactive_thread.stop()
            
            if self.command_thread.isRunning():
                self.command_thread.wait(3000)
            if self.interactive_thread.isRunning():
                self.interactive_thread.wait(3000)
        
        self._flush_log_buffer()
        self._info_timer.stop()
        self.save_config()
        event.accept()


class ContactDialog(QDialog):
    QR_CODE_PATH = APP_DIR / "imags" / "wechat_qrcode.png"
    
    def __init__(self, parent=None):
        super().__init__(parent)
        self.setWindowTitle("联系作者")
        self.setFixedSize(400, 480)
        self.setup_ui()
    
    def setup_ui(self):
        layout = QVBoxLayout(self)
        layout.setAlignment(Qt.AlignCenter)
        
        title_label = QLabel("扫描二维码联系作者")
        title_label.setStyleSheet("font-size: 18px; font-weight: bold; color: #00d9ff;")
        title_label.setAlignment(Qt.AlignCenter)
        layout.addWidget(title_label)
        
        desc_label = QLabel("微信扫码添加请备注sqlmap-GUI")
        desc_label.setAlignment(Qt.AlignCenter)
        desc_label.setStyleSheet("color: #888; margin-top: 10px;")
        layout.addWidget(desc_label)
        
        self.image_label = QLabel()
        self.image_label.setAlignment(Qt.AlignCenter)
        self.image_label.setStyleSheet("""
            background-color: #fff;
            border: 3px solid #3a5a7a;
            border-radius: 10px;
            padding: 10px;
        """)
        self.image_label.setFixedSize(280, 280)
        layout.addWidget(self.image_label, alignment=Qt.AlignCenter)
        
        self.load_qrcode()
        
        tip_label = QLabel("如有问题或建议，欢迎联系")
        tip_label.setAlignment(Qt.AlignCenter)
        tip_label.setStyleSheet("color: #666; margin-top: 15px;")
        layout.addWidget(tip_label)
        
        close_btn = QPushButton("关闭")
        close_btn.clicked.connect(self.accept)
        close_btn.setFixedWidth(100)
        layout.addWidget(close_btn, alignment=Qt.AlignCenter)
    
    def load_qrcode(self):
        if self.QR_CODE_PATH.exists():
            pixmap = QPixmap(str(self.QR_CODE_PATH))
            if not pixmap.isNull():
                scaled_pixmap = pixmap.scaled(
                    250, 250, 
                    Qt.KeepAspectRatio, 
                    Qt.SmoothTransformation
                )
                self.image_label.setPixmap(scaled_pixmap)
            else:
                self.show_placeholder()
        else:
            self.show_placeholder()
    
    def show_placeholder(self):
        self.image_label.setText("二维码图片不存在\n请检查 imags/wechat_qrcode.png")


def main():
    app = QApplication(sys.argv)
    app.setStyle('Fusion')
    
    window = SqlmapGUI()
    window.show()
    
    sys.exit(app.exec_())


if __name__ == "__main__":
    main()