{"repo":"eslam3kl/SQLiDetector","free":true,"listed":false,"github":"https://github.com/eslam3kl/SQLiDetector","clone":"git clone https://github.com/eslam3kl/SQLiDetector.git","description":"Simple python script supported with BurpBouty profile that helps you to detect SQL injection \"Error based\" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.","language":"Clojure","stars":640,"topics":["bug-bounty","bugbounty","infosec","penetration-testing","pentesting","sqlinjection"],"license":null,"category":"security-tools","readme_excerpt":"SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection \"Error based\" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. Description The main idea for the tool is scanning for Error Based SQL Injection by using different payloads like And match for 152 error regex patterns for different databases. Source: https://github.com/sqlmapproject/sqlmap/blob/master/data/xml/errors.xml How does it work? It's very simple, just organize your steps as follows 1. Use your subdomain grabber script or tools. 2. Pass all collected subdomains to httpx or httprobe to get only live subs. 3. Use your links and URLs tools to grab all waybackurls like waybackurls, gau, gauplus, etc. 4. Use URO tool to filter them and reduce the noise. 5. Grep to get all the links that contain parameters only. You can use Grep or GF tool. 6. Pass the final URLs file to the tool, and it will test them. The final schema of URLs that you will pass to the tool must be like this one Installation and Usage Just run the following command to install the required libraries. To run the tool itself. BurpBounty Module I've created a burpbounty profile that uses the same payloads add injecting them at multiple positions like + Parameter name + Parameter value + Headers + Paths I think it's more effective and will helpful for POST request that you can't test them using the Python script. How does it test the parameter? What's","default_branch":null,"files":null,"tree":[],"storefront":"/r/eslam3kl","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/eslam3kl/SQLiDetector/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}