SQLProbe - SQL Injection Assessment Framework v1.0 (2026)

A production-grade, modular framework for authorized security testing of SQL injection vulnerabilities with modern 2026 features.

Legal Notice

WARNING: This tool is provided for authorized security testing only.

• Unauthorized scanning of systems you do not own or have explicit written permission to test is illegal.
• By using this tool, you agree to use it only in compliance with all applicable laws and with proper authorization.
• The authors assume no liability for any misuse or damage caused by this tool.

What's New in v1.0 (2026)

• Auto-Parameters Discovery - Automatically finds parameters from forms, links, JavaScript, and common parameter names
• WAF/Cloud Detection - Detects Cloudflare, Akamai, AWS WAF, Imperva, FortiWeb, ModSecurity, Sucuri
• CDN Identification - Identifies CloudFront, Fastly, CDNJS, jsDelivr
• Tech Stack Fingerprinting - Detects React, Vue, Angular, Node.js, python3, PHP, Java, Apache, Nginx
• Header Injection Testing - Tests X-Forwarded-For, User-Agent, custom headers
• Cookie Injection Testing - Tests cookie values for SQL injection
• JSON API Testing - Tests JSON body parameters
• GraphQL Testing - Tests GraphQL endpoints
• 87+ Payloads - Comprehensive payloads (Boolean, Error, UNION, Time-based, WAF bypass)
• Improved Detection - Better confidence scoring with multi-indicator analysis

Features

• Async Engine: High-performance async HTTP engine with connection pooling, retry logic, and rate limiting.
• Smart Crawler: Recursive crawling with form and parameter extraction.
• Payload Engine: 87+ payloads across 9 categories (Boolean, Error, Time-based, UNION, Blind, GraphQL, JSON, NoSQL).
• Detection Engine: Multiple detection methods with confidence scoring.
• WAF Detection: Detects and adapts to 8+ WAF systems.
• Auto-Parameter Discovery: Forms, links, JS, common params.
• Reporting: JSON and HTML report generation.
• Plugin System: Extensible architecture for custom payloads and detection methods.
• CLI: Rich command-line interface with progress display.

Installation

pip3 install -r requirements.txt
python3 -m pip install --user . --break-system-packages

Quick Start

Command Line

# Basic scan
python3 -m sqlprobe -u "http://testasp.vulnweb.com"# With depth and concurrency
python3 -m sqlprobe -u "http://testasp.vulnweb.com" -v --depth 3 --concurrency 20
# With proxy
python3 -m sqlprobe -u "http://testasp.vulnweb.com" -p -v "http://localhost:8080"# Generate JSON report
python3 -m sqlprobe -u "http://testasp.vulnweb.com" -v -o results --format json

Advanced Scanner (Standalone)

python3 advanced_scan.py "http://testasp.vulnweb.com/page?id=1"

python3 API

importasynciofromsqlprobe.engineimportAssessmentEnginefromsqlprobe.reportingimportReportGeneratorasyncdefmain():
engine=AssessmentEngine(
target="http://testasp.vulnweb.com/page?id=1",
depth=2,
concurrency=10,
)
results=awaitengine.run()
report=ReportGenerator(results=results, output_format="json")
report.generate()
asyncio.run(main())

Command-Line Options

Option	Description	Default
-u, --target	Target URL to test	Required
-d, --depth	Crawling depth	2
-c, --concurrency	Concurrent requests	10
-t, --timeout	Request timeout (seconds)	30
-p, --proxy	HTTP/HTTPS proxy	None
-o, --output	Output file path	None
-f, --format	Output format (json/both)	json
-v, --verbose	Increase verbosity	0
--save-session	Save scan session	None
--load-session	Load scan session	None
--whitelist	Allowed domains	None

Payload Categories

Category	Count	Description
Boolean-based	23	Classic true/false injection
Error-based	17	SQL syntax error detection
UNION-based	16	UNION SELECT injection
Time-based	14	Blind injection with delays
GraphQL	6	GraphQL endpoint testing
JSON API	4	JSON body parameter testing
NoSQL	6	MongoDB injection
WAF Bypass	10+	Modern bypass techniques

Architecture

sqlprobe/
├── engine/ # Async HTTP engine and main assessment engine
├── payloads/ # 87+ payload generation and mutation
├── detection/ # Detection engine and result analysis
├── crawler/ # Smart web crawler
├── analyzer/ # Result correlation and analysis
├── waf/ # WAF detection and adaptation
├── reporting/ # Report generation
├── cli/ # Command-line interface
├── plugins/ # Plugin system
└── utils/ # Utilities and safety controls

Safety Controls

• Domain whitelist enforcement.
• Rate limiting.
• Target confirmation required.
• Legal warning banner.
• No exploitation or data extraction.
• Detection-only (no data extraction).

Testing

python3 -m sqlprobe -u "http://testasp.vulnweb.com/Login.asp?RetURL=test" -v --depth 1

Demo Screenshots

License

MIT License - See LICENSE file for details.

Disclaimer

This tool is provided as-is for educational and authorized security testing purposes. Users are responsible for ensuring compliance with all applicable laws and regulations.