🔍 SQL Injection Scanner

An async error-based SQL injection scanner that probes HTML forms on a target URL for common SQL injection vulnerabilities.

⚠️ For authorized security testing only. Only use against systems you own or have explicit permission to test.

---

Features

• Async-first — built on asyncio + aiohttp for concurrent form probing
• Semaphore-controlled concurrency — configurable limit to avoid overwhelming the target
• Error-based detection — matches known SQL error signatures across MySQL, MSSQL, Access, and more
• Smart payload injection — preserves CSRF tokens and hidden fields; skips non-injectable inputs
• Clean data model — typed dataclass-based form parsing (FormDetails, InputField)
• CLI interface — simple positional argument with --timeout and --concurrency flags

---

Requirements

• Python 3.10+
• aiohttp
• beautifulsoup4
• A banner.py module exposing ascii (used for the CLI banner)

---

Installation

git clone https://github.com/your-username/sql-injection-scanner.git
cd sql-injection-scanner
pip install -r requirements.txt

requirements.txt

aiohttp>=3.9
beautifulsoup4>=4.12

---

Usage

CLI

python SQL_scan.py <url> [--timeout SECONDS] [--concurrency N]

Argument	Default	Description
url	(required)	Target URL (must be http:// or https://)
--timeout	10.0	Per-request timeout in seconds
--concurrency	10	Max simultaneous HTTP probes

Examples:

# Basic scan
python SQL_scan.py https://example.com/login

# Custom timeout and concurrency
python SQL_scan.py https://example.com/search --timeout 5 --concurrency 20

Programmatic API

import asyncio
from SQL_scan import sql_injection_scan

vulnerable_forms = asyncio.run(
    sql_injection_scan(
        "https://example.com/login",
        timeout_seconds=10.0,
        max_concurrency=5,
    )
)

print(f"Vulnerable form indices: {vulnerable_forms}")

You can also pass a pre-built aiohttp.ClientSession for reuse or testing:

import aiohttp
import asyncio
from SQL_scan import sql_injection_scan

async def main():
    async with aiohttp.ClientSession() as session:
        results = await sql_injection_scan(
            "https://example.com",
            session=session,
        )
    print(results)

asyncio.run(main())

---

How It Works

Target URL
    │
    ▼
Fetch page HTML
    │
    ▼
Extract all <form> elements
    │
    ▼
For each form (concurrent, semaphore-limited):
    │
    ├── Skip if no injectable inputs
    │
    ├── Inject ' (single quote)  ──► Submit ──► Check response for SQL errors
    │
    └── Inject " (double quote)  ──► Submit ──► Check response for SQL errors
                                                        │
                                              Vulnerable? ──► Log warning

Detected SQL Error Signatures

Database	Example Error Pattern
MySQL	you have an error in your sql syntax, warning: mysql
MSSQL	microsoft ole db provider for sql server, unclosed quotation mark after the character string
MS Access	odbc microsoft access driver
Generic	quoted string not properly terminated, syntax error or access violation

---

Project Structure

sql-injection-scanner/
├── SQL_scan.py       # Main scanner module
├── banner.py         # ASCII banner (exposes `ascii`)
├── requirements.txt
└── README.md

---

Output Example

2024-01-15 12:00:01 [INFO]  Detected 3 form(s) on https://example.com/login.
2024-01-15 12:00:02 [WARNING] ⚠️  Vulnerability found — form #1 on https://example.com/login (trigger char: "'")
2024-01-15 12:00:03 [WARNING] 🚨 1 vulnerable form(s) at indices: [1]

---

Limitations

• Error-based only — does not detect blind, time-based, or out-of-band SQL injection
• Form-scoped — does not crawl the site or test URL parameters outside of forms
• No JavaScript rendering — relies on static HTML; does not support SPAs or dynamically injected forms

---

Legal Disclaimer

This tool is intended for authorized penetration testing and educational purposes only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal and unethical. The authors assume no liability for misuse.

---

License

MIT