A lightweight, multithreaded SQL-injection screening tool for authorized security testing. It flags endpoints that return database error signatures or time-based anomalies so you can prioritise them for manual verification.
gorib (গরিব — "humble") is my personal handle: small, honest tools that do one job well.
This tool sends crafted input to web applications and is intended exclusively for:
- systems you own, or
- targets you have explicit, written permission to test (a signed engagement, a bug-bounty program whose scope includes the target, or a lab you control).
Running it against systems without authorization may be illegal. You are responsible for how you use it. See LICENSE.
This is a triage scanner, not an exploitation framework. It:
- injects a small set of classic payloads into each URL parameter,
- looks for error-based signatures (
SQL syntax,ORA-,SQLSTATE, …) and time-based delays (SLEEP), - notes endpoints that look WAF-protected (403/429 or block pages),
- saves the raw response for any hit so you can review it by hand.
A hit is a lead, not proof. Always confirm manually (or with a dedicated tool like sqlmap) before reporting anything.
git clone https://github.com/azmolhaque/sqli.py
cd sqli.py
pip install -r requirements.txt# One target per line in targets.txt
python3 sqli.py -i targets.txt -o hits.txt -m get --threads 10 --param id| Flag | Description | Default |
|---|---|---|
-i, --input |
File with one URL per line | targets.txt |
-o, --output |
File to write confirmed hits to | hits.txt |
-m, --method |
get or post |
get |
--param |
Only inject this parameter | all params |
--proxy |
Route through a proxy (e.g. Burp) | none |
--threads |
Concurrent workers | 6 |
Raw responses for each hit are written to responses/.
- Per-parameter differential timing to reduce false positives
- Optional JSON output for pipeline use
- Configurable payload/error-signature files
MIT — see LICENSE.