Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/eslam3kl/SQLiDetector
Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.
https://github.com/eslam3kl/SQLiDetector
bug-bounty bugbounty infosec penetration-testing pentesting sqlinjection
Last synced: 26 days ago
JSON representation
Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.
- Host: GitHub
- URL: https://github.com/eslam3kl/SQLiDetector
- Owner: eslam3kl
- Created: 2022-07-27T12:04:11.000Z (over 2 years ago)
- Default Branch: main
- Last Pushed: 2024-10-27T02:23:20.000Z (about 2 months ago)
- Last Synced: 2024-10-27T03:26:21.303Z (about 2 months ago)
- Topics: bug-bounty, bugbounty, infosec, penetration-testing, pentesting, sqlinjection
- Language: Clojure
- Homepage: https://eslam3kl.medium.com
- Size: 12.5 MB
- Stars: 582
- Watchers: 15
- Forks: 101
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
- WebHackersWeapons - SQLiDetector
- awesome-hacking-lists - eslam3kl/SQLiDetector - Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for differe (BlitzBasic)
README
# SQLiDetector
Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.
```
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
| S|Q|L|i| |D|e|t|e|c|t|o|r|
| Coded By: Eslam Akl @eslam3kll & Khaled Nassar @knassar702
| Version: 1.0.0
| Blog: eslam3kl.medium.com
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
```
## Description
The main idea for the tool is scanning for Error Based SQL Injection by using different payloads like
```
'123
''123
`123
")123
"))123
`)123
`))123
'))123
')123"123
[]123
""123
'"123
"'123
\123
```
And match for 152 error regex patterns for different databases.
Source: https://github.com/sqlmapproject/sqlmap/blob/master/data/xml/errors.xml
## How does it work?
It's very simple, just organize your steps as follows
1. Use your subdomain grabber script or tools.
2. Pass all collected subdomains to httpx or httprobe to get only live subs.
3. Use your links and URLs tools to grab all waybackurls like waybackurls, gau, gauplus, etc.
4. Use URO tool to filter them and reduce the noise.
5. Grep to get all the links that contain parameters only. You can use Grep or GF tool.
6. Pass the final URLs file to the tool, and it will test them.
The final schema of URLs that you will pass to the tool must be like this one
```
https://aykalam.com?x=test&y=fortest
http://test.com?parameter=ayhaga
```
## Installation and Usage
Just run the following command to install the required libraries.
```
~/eslam3kl/SQLiDetector# pip3 install -r requirements.txt
```
To run the tool itself.
```
# cat urls.txt
http://testphp.vulnweb.com/artists.php?artist=1
# python3 sqlidetector.py -h
usage: sqlidetector.py [-h] -f FILE [-w WORKERS] [-p PROXY] [-t TIMEOUT] [-o OUTPUT]
A simple tool to detect SQL errors
optional arguments:
-h, --help show this help message and exit]
-f FILE, --file FILE [File of the urls]
-w WORKERS, --workers [WORKERS Number of threads]
-p PROXY, --proxy [PROXY Proxy host]
-t TIMEOUT, --timeout [TIMEOUT Connection timeout]
-o OUTPUT, --output [OUTPUT [Output file]
# python3 sqlidetector.py -f urls.txt -w 50 -o output.txt -t 10
```
## BurpBounty Module
I've created a burpbounty profile that uses the same payloads add injecting them at multiple positions like
+ Parameter name
+ Parameter value
+ Headers
+ Paths
I think it's more effective and will helpful for POST request that you can't test them using the Python script.
## How does it test the parameter?
What's the difference between this tool and any other one?
If we have a link like this one `https://example.com?file=aykalam&username=eslam3kl` so we have 2 parameters. It creates 2 possible vulnerable URLs.
1. It will work for every payload like the following
```
https://example.com?file=123'&username=eslam3kl
https://example.com?file=aykalam&username=123'
```
2. It will send a request for every link and check if one of the patterns is existing using regex.
3. For any vulnerable link, it will save it at a separate file for every process.
## Upcoming updates
- [x] Output json option.
- [x] Adding proxy option.
- [x] Adding threads to increase the speed.
- [x] Adding progress bar.
- [x] Adding more payloads.
- [x] Adding BurpBounty Profile.
- [x] Inject the payloads in the parameter name itself.
If you want to contribute, feel free to do that. You're welcome :)
## Thanks to
Thanks to Mohamed El-Khayat and Orwa for the amazing paylaods and ideas. Follow them and you will learn more
```
https://twitter.com/Mohamed87Khayat
https://twitter.com/GodfatherOrwa
```
## Contributors
## Stay in touch <3
[LinkedIn](https://www.linkedin.com/in/eslam3kl/) | [Blog](https://eslam3kl.medium.com/) | [Twitter](https://twitter.com/eslam3kll)