## https://sploitus.com/exploit?id=894A03D8-1903-5FA5-B05E-6FA17F6F67C2
# 🛡️ SQLi Defender
### Real-Time SQL Injection Detection & Prevention System
SQLi Defender is a web security middleware designed to detect, analyze, monitor, and block SQL Injection attempts in real time.
The system inspects incoming HTTP requests, normalizes user-controlled input, detects SQL Injection patterns, calculates a risk score, and takes an automated security decision based on the severity of the request.
---
## 🚀 Features
- 🔍 Real-time SQL Injection detection
- 🛡️ Automatic malicious request blocking
- 📊 Risk scoring engine
- 🚨 LOW / MEDIUM / HIGH / CRITICAL risk classification
- 👁️ Monitoring mode for suspicious requests
- 📝 Security event logging
- 📈 Live security dashboard
- 🔄 Automatic dashboard refresh
- 🌐 Query parameter inspection
- 📦 Request body inspection
- 🔐 Login request protection
- 🧹 Input normalization
- 🧠 Pattern-based SQL Injection detection
- ⚡ Fast middleware-based request inspection
- 💾 SQLite-based security event storage
- 🎨 Cybersecurity-themed dashboard
---
## 🎯 Problem Statement
SQL Injection is one of the most common web application security vulnerabilities.
Attackers can manipulate application input to alter SQL queries and potentially access, modify, or delete unauthorized database information.
Traditional applications may validate input only at individual endpoints.
SQLi Defender provides a centralized security layer that inspects incoming requests before they reach the application's business logic.
---
## 💡 Solution
SQLi Defender works as a security middleware between the client and the application.
```text
Client Request
│
▼
┌─────────────────────┐
│ Request Middleware │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ Input Normalization │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ SQLi Detection │
└──────────┬──────────┘
│
▼
┌─────────────────────┐
│ Risk Engine │
│ Score Calculation │
└──────────┬──────────┘
│
▼
Security Decision
/ \
/ \
▼ ▼
MONITOR BLOCK
│ │
▼ ▼
Application HTTP 403
│
▼
SQLite Security Logs
│
▼
Live Dashboard
```
---
# 🧠 How It Works
## 1. Request Interception
Every incoming HTTP request is inspected by the security middleware.
Example:
```text
GET /products?q=laptop
```
or:
```text
POST /login
username=...
password=...
```
---
## 2. Input Extraction
The system examines user-controlled input from different locations such as:
- Query parameters
- Request body
- Login fields
- Other supported request parameters
---
## 3. Input Normalization
Before detection, input is normalized so that encoded or obfuscated input can be analyzed more effectively.
Examples of transformations include:
- URL decoding
- Case normalization
- Whitespace normalization
- Pattern normalization
---
## 4. SQL Injection Detection
The detection engine looks for suspicious SQL Injection characteristics.
Examples include:
- Boolean SQL expressions
- Multiple quote characters
- SQL comment syntax
- UNION SELECT structures
- Multiple SQL keywords
- Suspicious SQL operators
- Other malicious query patterns
---
## 5. Risk Scoring
Detected indicators contribute to a risk score.
Example:
```text
Suspicious boolean expression
+
Multiple quote characters
↓
Risk Score = 55
↓
MEDIUM
↓
MONITOR
```
A more severe request can produce:
```text
UNION SELECT
+
SQL comment syntax
+
Multiple SQL keywords
↓
Risk Score = 100
↓
CRITICAL
↓
BLOCK
```
---
# 🛡️ Detection & Prevention
SQLi Defender uses risk-based decisions.
| Risk Level | Typical Action |
|------------|----------------|
| LOW | ALLOW |
| MEDIUM | MONITOR |
| HIGH | BLOCK |
| CRITICAL | BLOCK |
This allows the system to avoid blindly blocking every request containing SQL-related words.
---
# 📊 Live Dashboard
The project includes a real-time security dashboard that displays:
- Detected Requests
- Blocked Requests
- Monitored Requests
- High-Risk Events
- Critical Events
- Recent Security Detections
- Risk Score
- Request Method
- Request Path
- Parameter
- Action
- HTTP Response Status
- Detection Reason
The dashboard automatically refreshes to display newly recorded security events.
---
# 🧪 Example Detection
### Suspicious request
```text
GET /products?q=' OR '1'='1
```
The detector can identify indicators such as:
```text
Boolean SQL expression
Multiple quote characters
```
Example decision:
```text
Risk: MEDIUM
Score: 55
Action: MONITOR
HTTP Status: 200
```
---
### High-risk request
```text
GET /products?q=UNION SELECT 1--
```
Example decision:
```text
Risk: CRITICAL
Score: 100
Action: BLOCK
HTTP Status: 403
```
---
# 📝 Security Logging
Every detected security event can be stored with information such as:
```text
Timestamp
Client IP
HTTP Method
Request Path
Parameter
Location
Risk Level
Risk Score
Action
Detection Reasons
Response Status
```
This allows security events to be reviewed later.
---
# 🧰 Technology Stack
### Backend
- Python
- FastAPI
- Uvicorn
### Security
- Custom SQL Injection Detection Engine
- Request Middleware
- Risk Scoring Engine
- Input Normalization
### Database
- SQLite
- SQLAlchemy
### Frontend
- HTML
- CSS
- JavaScript
### Development
- Python Virtual Environment
- Git
- GitHub
---
# 📁 Project Structure
```text
SQLi-Prevention-System/
│
├── app/
│ ├── main.py
│ ├── database.py
│ ├── models.py
│ │
│ ├── security/
│ │ ├── detector.py
│ │ ├── middleware.py
│ │ ├── normalizer.py
│ │ └── risk_engine.py
│ │
│ └── templates/
│ ├── index.html
│ ├── login.html
│ ├── products.html
│ └── register.html
│
├── requirements.txt
├── README.md
├── .gitignore
└── ...
```
---
# ⚙️ Installation
## 1. Clone the repository
```bash
git clone https://github.com/YOUR_USERNAME/SQLi-Defender.git
```
```bash
cd SQLi-Defender
```
---
## 2. Create a virtual environment
### Windows
```bash
python -m venv venv
```
Activate:
```bash
venv\Scripts\activate
```
---
## 3. Install dependencies
```bash
pip install -r requirements.txt
```
---
## 4. Start the application
```bash
uvicorn app.main:app --reload
```
The application should be available at:
```text
http://127.0.0.1:8000
```
---
# 📊 Dashboard
Open:
```text
http://127.0.0.1:8000/dashboard
```
The dashboard provides real-time visibility into detected and blocked requests.
---
# 🔬 Testing
The project can be tested using controlled requests against the local application.
### Health Check
```text
GET /health
```
### Normal Request
```text
GET /products?q=laptop
```
### Suspicious Request
```text
GET /products?q=' OR '1'='1
```
### High-Risk SQL Injection Test
```text
GET /products?q=UNION SELECT 1--
```
Expected high-risk behavior:
```text
Risk: CRITICAL
Score: 100
Action: BLOCK
HTTP Status: 403
```
---
# 📈 Security Monitoring
The dashboard provides visibility into:
```text
Detected Requests
↓
Risk Classification
↓
Monitor / Block
↓
Security Event Logging
↓
Live Dashboard
```
---
# 🎓 Project Objectives
The main objectives of SQLi Defender are:
1. Detect SQL Injection attempts in real time.
2. Identify suspicious request parameters.
3. Calculate a risk score for detected requests.
4. Automatically block high-risk requests.
5. Monitor medium-risk requests.
6. Record security events.
7. Provide a security monitoring dashboard.
8. Demonstrate practical web application security concepts.
---
# 🔐 Security Note
This project is intended for educational, research, and authorized security testing purposes.
Testing should only be performed against applications and systems for which you have permission.
SQLi Defender is a defensive security project and should be deployed with additional security controls in production environments.
---
# 🚧 Limitations
SQL Injection detection based on patterns and heuristics cannot guarantee detection of every possible SQL Injection technique.
Production deployments should additionally use:
- Parameterized queries
- Prepared statements
- ORM protections
- Strict input validation
- Least-privilege database accounts
- Secure authentication
- Rate limiting
- Centralized logging
- Web Application Firewall controls
- Security testing
SQLi Defender is designed as an additional defensive layer rather than a replacement for secure application development practices.
---
# 🔮 Future Improvements
Possible future enhancements include:
- Machine Learning-based SQLi detection
- Advanced anomaly detection
- IP reputation analysis
- Rate-limit based protection
- Attack frequency analysis
- Geo/IP intelligence
- Email/Telegram security alerts
- Exportable security reports
- Admin authentication
- PostgreSQL/MySQL support
- Docker deployment
- REST API security analytics
- Advanced WAF capabilities
- Automated security test suite
---
# 👨💻 Author
**Ayush Shukla**
Cyber Security Student
Interested in:
- Web Application Security
- Penetration Testing
- VAPT
- Security Automation
- Threat Detection
- Defensive Security
---
# ⭐ Project
If you find this project useful for learning or security research, consider giving the repository a star.
---
## ⚠️ Disclaimer
This project is developed for educational and authorized security testing purposes only.
The author is not responsible for unauthorized use or misuse of this software.