README
¶
sqleech
Next-generation SQL injection testing tool written in Go.
WARNING: This tool is intended for authorized penetration testing and security research only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing.
Features
- High Performance: Concurrent scanning with goroutine-based worker pool (10-100x faster than traditional tools)
- Zero Dependencies: Single binary deployment — no runtime required
- Multiple Techniques: Error-based, Boolean-blind, Time-blind, UNION-based, Stacked queries
- DBMS Support: MySQL, PostgreSQL, MSSQL, Oracle, SQLite
- Smart Detection: Statistical response analysis with adaptive thresholds
- WAF Bypass: Built-in tamper system with 20+ evasion modules
- Modern Targets: GraphQL, JSON body, REST API parameter injection
- CI/CD Ready: JSON and SARIF output for DevSecOps integration
- Session Resume: Save and resume interrupted scans
- Library Mode: Use as a Go library in your own tools
Installation
go install github.com/0x6d61/sqleech/cmd/sqleech@latest
Quick Start
# Basic scan
sqleech scan -u "http://target.com/page?id=1"
# POST request scan
sqleech scan -u "http://target.com/login" -d "user=admin&pass=test" --method POST
# With proxy and specific techniques
sqleech scan -u "http://target.com/page?id=1" --proxy http://127.0.0.1:8080 --technique B,E
# JSON output
sqleech scan -u "http://target.com/page?id=1" -f json -o result.json
Build
make build # Build binary
make test # Run tests
make lint # Run linter
make all # Format, vet, lint, test, build
License
MIT License - see LICENSE for details.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
sqleech
command
|
|
|
internal
|
|
|
dbms
Package dbms provides DBMS-specific SQL syntax and query knowledge base.
|
Package dbms provides DBMS-specific SQL syntax and query knowledge base. |
|
detector
Package detector provides parameter extraction and SQL injection detection.
|
Package detector provides parameter extraction and SQL injection detection. |
|
engine
Package engine provides the core scan orchestration pipeline.
|
Package engine provides the core scan orchestration pipeline. |
|
fingerprint
Package fingerprint provides DBMS identification through behavioral probing.
|
Package fingerprint provides DBMS identification through behavioral probing. |
|
payload
Package payload provides SQL injection payload construction with context-aware boundary detection and encoding utilities.
|
Package payload provides SQL injection payload construction with context-aware boundary detection and encoding utilities. |
|
report
Package report provides formatters for scan result output.
|
Package report provides formatters for scan result output. |
|
session
Package session provides persistence for scan state, allowing scans to be saved, resumed, and reviewed.
|
Package session provides persistence for scan state, allowing scans to be saved, resumed, and reviewed. |
|
tamper
Package tamper provides payload transformation functions that help bypass Web Application Firewalls (WAFs) and input filters during SQL injection testing.
|
Package tamper provides payload transformation functions that help bypass Web Application Firewalls (WAFs) and input filters during SQL injection testing. |
|
technique
Package technique defines the interface for SQL injection detection and exploitation techniques (error-based, boolean-based, time-based, etc.).
|
Package technique defines the interface for SQL injection detection and exploitation techniques (error-based, boolean-based, time-based, etc.). |
|
technique/boolean
Package boolean implements boolean-blind SQL injection detection and data extraction.
|
Package boolean implements boolean-blind SQL injection detection and data extraction. |
|
technique/errorbased
Package errorbased implements the error-based SQL injection technique.
|
Package errorbased implements the error-based SQL injection technique. |
|
technique/timebased
Package timebased implements the time-based blind SQL injection technique.
|
Package timebased implements the time-based blind SQL injection technique. |
|
technique/union
Package union implements the UNION-based SQL injection technique.
|
Package union implements the UNION-based SQL injection technique. |
|
testutil
Package testutil provides test utilities including a mock vulnerable web server for integration testing of the sqleech SQL injection scanner.
|
Package testutil provides test utilities including a mock vulnerable web server for integration testing of the sqleech SQL injection scanner. |
|
transport
Package transport provides the HTTP transport abstraction layer used by all injection testing flows.
|
Package transport provides the HTTP transport abstraction layer used by all injection testing flows. |
Click to show internal directories.
Click to hide internal directories.