SQLiDetector: Python Script Simplifies Error-Based SQL Injection Detection

'123
''123
`123
")123
"))123
`)123
`))123
'))123
')123"123
[]123
""123
'"123
"'123
\123

And match for 152 error regex patterns for different databases.

Feature

•  Output json option.
•  Adding proxy option.
•  Adding threads to increase the speed.
•  Adding progress bar.
•  Adding more payloads.
•  Adding BurpBounty Profile.
•  Inject the payloads in the parameter name itself.

How does it work?

It’s very simple, just organize your steps as follows

1. Use your subdomain grabber script or tools.
2. Pass all collected subdomains to httpx or httprobe to get only live subs.
3. Use your links and URLs tools to grab all waybackurls like waybackurls, gau, gauplus, etc.
4. Use URO tool to filter them and reduce the noise.
5. Grep to get all the links that contain parameters only. You can use Grep or GF tool.
6. Pass the final URLs file to the tool, and it will test them.

The final schema of URLs that you will pass to the tool must be like this one

https://aykalam.com?x=test&y=fortest
http://test.com?parameter=ayhaga

How does it test the parameter?

What’s the difference between this tool and any other one? If we have a link like this one https://example.com?file=aykalam&username=eslam3kl so we have 2 parameters. It creates 2 possible vulnerable URLs.

1. It will work for every payload like the following

   https://example.com?file=123'&username=eslam3kl
   https://example.com?file=aykalam&username=123'

2. It will send a request for every link and check if one of the patterns is existing using regex.
3. For any vulnerable link, it will save it at a separate file for every process.

Download & Use