<commit_before># Overview

This is a script to automate Blind SQL Injection.

Given a known injection, this script will automatically work out the value of whatever string you wish to acquire.


# Requirements

Python [`requests`](http://docs.python-requests.org/en/master/) library.
Install using `pip install requests`.

# Usage

There are Four parameters:
* target: The target as a url. This must specify the protocol, i.e. `https://...`.
* param: The injectible parameter. We assume this is a GET parameter.
* base-query: The base SQL statement to use. Usually of the form `... AND {} OR SLEEP(1) OR ...`. Use the usual python format-string format (i.e. `{}`) to denote where you want the conditional to go.
* var: The variable you want to test. e.g. `USER()`


# TODO

Possible improvements are:
* Detecting the Type, and picking a suitable injection, so we aren't limited to just strings.
* Clean it up a bit more; the code is not DRY.
* Add a timeout between requests so we don't spam the server!
* Support for POST and Cookie parameters<commit_msg>add limitations<commit_after># Overview

This is a script to automate Blind SQL Injection.

Given a known injection, this script will automatically work out the value of whatever string you wish to acquire.


# Requirements

Python [`requests`](http://docs.python-requests.org/en/master/) library.
Install using `pip install requests`.

# Usage

There are Four parameters:
* target: The target as a url. This must specify the protocol, i.e. `https://...`.
* param: The injectible parameter. We assume this is a GET parameter.
* base-query: The base SQL statement to use. Usually of the form `... AND {} OR SLEEP(1) OR ...`. Use the usual python format-string format (i.e. `{}`) to denote where you want the conditional to go.
* var: The variable you want to test. e.g. `USER()`

# Limitations

* We only consider the ASCII alphabet, excluding null.
* We only consider string lengths from 0 to 1000.
* We use ANSI escape codes to give a live display.
* We are limited to injection on strings (at the moment).
* We are limited to GET parameters.

# TODO

Possible improvements are:
* Clean it up a bit more; the code is not DRY.
* Add a timeout between requests so we don't spam the server!
* Detecting the Type, and picking a suitable injection, so we aren't limited to just strings.
* Support for POST and Cookie parameters
{'fraction_non_alphanumeric': 0.08827238335435057, 'fraction_numerical': 0.0029424127784783522, 'mean_word_length': 3.7791164658634537, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3762992', 'n_tokens_mistral': 678, 'n_tokens_neox': 632, 'n_words': 354}