From 03719c6368dc04c55bcd25067eeab8b4249b4a7a Mon Sep 17 00:00:00 2001 From: Muhammad Danial <149725207+danialhalo@users.noreply.github.com> Date: Sun, 19 Nov 2023 00:27:51 +0500 Subject: [PATCH] Update README.md --- README.md | 37 ++++++++++++++++++++++++++++++------- 1 file changed, 30 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 2151109..e926476 100644 --- a/README.md +++ b/README.md @@ -17,7 +17,7 @@ Contributing •
-**SqliSniper** is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using advanced multi-threaded techniques. +**SqliSniper** is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using multi-threaded, ensuring speed and efficiency. Unlike other scanners, SqliSniper is designed to eliminates false positives through and send alerts upon detection, with the built-in Discord notification functionality.  @@ -36,7 +36,7 @@ cd SQLSniper chmod +x sqlisniper.py pip3 install -r requirements.txt ``` -# Usage: +# Usage This will display help for the tool. Here are all the options it supports. ``` @@ -72,23 +72,23 @@ options: --threads THREADS Number of threads ``` -# Running SQliSniper +# Running SqliSniper ### Single Url Scan The url can be provided with `-u flag` for single site scan ``` ./sqlisniper.py -u http://example.com ``` ### File Input -This will run the tool with the `-r flag` against all the urls in urls.txt. +The `-r flag` allows SqliSniper to read a file containing multiple URLs for simultaneous scanning. ``` ./sqlisniper.py -r url.txt ``` -### Pipeline +### piping URLs The SqliSniper can also worked with the pipeline input with `-p flag` ``` cat url.txt | ./sqlisniper.py -p ``` -This is helpful when integrating with other tools. For example we can use the subfinder , httpx and then pipe the output to SqliSniper for mass scanning +The pipeline feature facilitates seamless integration with other tools. For instance, you can utilize tools like subfinder and httpx, and then pipe their output to SqliSniper for mass scanning. ``` subfinder -silent -d google.com | sort -u | httpx -silent | ./sqlisniper.py -p ``` @@ -105,7 +105,7 @@ ubuntu:~/sqlisniper$ cat payloads.txt "0"XOR(if(now()=sysdate()%2Csleep(%__TIME_OUT__%)%2C0))XOR"Z" 0'XOR(if(now()=sysdate(),sleep(%__TIME_OUT__%),0))XOR'Z ``` -### Scanning with single payloads +### Scanning with Single Payloads If you want to only test with the single payload `--single-payload flag` can be used. Make sure to replace the sleep time with `%__TIME_OUT__%` ``` ./sqlisniper.py -r url.txt --single-payload "0'XOR(if(now()=sysdate(),sleep(%__TIME_OUT__%),0))XOR'Z" @@ -129,6 +129,22 @@ Threads can be defined with `--threads flag` ``` **Note:** It is crucial to consider that **employing a higher number of threads might lead to potential false positives or overlooking valid issues**. Due to the nature of time-based SQL injection it is recommended to use lower thread for more accurate detection. +--- + ++ +## Legal Disclaimer + +Usage of this tool for attacking targets without prior mutual consent is strictly prohibited. It is the end user's responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.. + + | +