SQLiv: Massive SQL Injection Scanner

Introduction

SQLiv is a powerful and efficient SQL injection scanner designed to handle large-scale scanning tasks. It supports multiple domain scanning with SQL injection dorks, targeted scanning, and reverse domain scanning. The script utilizes multiprocessing to ensure fast scanning of numerous URLs.

Features

• Multiple domain scanning using SQL injection dorks from Bing, Google, or Yahoo
• Targeted scanning by providing specific domains (with crawling)
• Reverse domain scanning to find websites hosted on the same server as the target URL
• Multiprocessing for fast scanning of multiple URLs

Installation

To install SQLiv, follow these steps:

$ git clone https://github.com/the-robot/sqliv.git
$ sudo python2 setup.py -i

Dependencies

SQLiv requires the following Python modules:

• bs4
• termcolor
• google
• nyawc

Pre-installed Systems

SQLiv comes pre-installed on BlackArch Linux.

Quick Tutorial

1. Multiple Domain Scanning with SQLi Dork

This mode searches multiple websites using a given dork and scans the results one by one.

$ python sqliv.py -d <SQLI DORK> -e <SEARCH ENGINE>
$ python sqliv.py -d "inurl:index.php?id=" -e google

2. Targeted Scanning

Provide only the domain name or a specific URL with query parameters. If only the domain name is provided, SQLiv will crawl the site, retrieve URLs with queries, and scan them one by one.

$ python sqliv.py -t <URL>
$ python sqliv.py -t www.example.com
$ python sqliv.py -t www.example.com/index.php?id=1

3. Reverse Domain Scanning

This mode performs a reverse domain lookup to find websites hosted on the same server as the target URL.

$ python sqliv.py -t <URL> -r

4. Dumping Scanned Results

You can save the scanned results as a JSON file by using the following command:

$ python sqliv.py -d <SQLI DORK> -e <SEARCH ENGINE> -o result.json

Viewing Help

To view the help message with all available options, run:

$ python sqliv.py --help

Usage

usage: sqliv.py [-h] [-d D] [-e E] [-p P] [-t T] [-r]

optional arguments:
  -h, --help  show this help message and exit
  -d D        SQL injection dork
  -e E        search engine [Google only for now]
  -p P        number of websites to look for in search engine
  -t T        scan target website
  -r          reverse domain

Development TODO

Future development plans include adding support for SQL injection vulnerability testing in POST forms.

Conclusion

SQLiv is an effective and fast tool for scanning websites for SQL injection vulnerabilities. Its multiple scanning modes and multiprocessing capabilities make it a valuable asset for security professionals. Remember to use this tool responsibly and only test systems you have permission to test.

Stay safe and secure!