blackSQL

An advanced SQL Injection scanner with support for Error-Based, Union-Based, Boolean-Based, and Time-Based detection techniques.

The Rust implementation is the main version. The original Python implementation is kept in legacy/ for reference.

Features

• Multiple SQL injection detection techniques:
  • Error-Based SQL Injection
  • Boolean-Based SQL Injection
  • Time-Based SQL Injection
  • Union-Based SQL Injection
• Multi-threaded scanning for faster results
• Database type detection (MySQL, PostgreSQL, MSSQL, Oracle, SQLite)
• Database enumeration (tables, columns, data) with --dump
• Colorized CLI output
• File logging (-o or logs/blacksql_<timestamp>.log) and JSON/CSV export to output/
• WAF detection and bypass techniques

Installation

From source (recommended):

git clone https://github.com/sharafdin/blackSQL.git
cd blackSQL
cargo build --release

Install the binary (after building):

cargo install --path .
# Then run from anywhere:
blacksql -u "http://example.com/page.php?id=1"

Legacy Python version:

cd legacy
pip install -r requirements.txt

Usage (Rust)

Basic scan:

./target/release/blacksql -u "http://example.com/page.php?id=1"

With options:

./target/release/blacksql -u "http://example.com/page.php?id=1" \
  --level 3 \
  --threads 10 \
  --dump \
  -o /path/to/scan.log

Option	Description
-u, --url	Target URL (required).
-p, --params	Parameters to scan (e.g. id,page). Default: from URL or --data.
--data	POST body (e.g. id=1&page=2) for POST-based scanning.
-c, --cookies	Cookie string (e.g. PHPSESSID=value; admin=0).
-t, --threads	Number of threads (default: 5).
--timeout	Request timeout in seconds (default: 10.0).
--proxy	Proxy URL (e.g. http://127.0.0.1:8080).
--level	Scan depth 1–3 (default: 1). Higher = more payloads.
--dump	When a parameter is vulnerable, enumerate DBs/tables/columns and include in results.
--batch	Non-interactive (no prompts).
-o, --output	Log file path. All scan messages are written here. If omitted, uses logs/blacksql_<timestamp>.log. JSON/CSV results are always written to output/blacksql_results_<timestamp>.json and .csv when vulnerabilities are found.

Output locations:

• Log file: Path from -o, or logs/blacksql_YYYYMMDD_HHMMSS.log.
• JSON/CSV (when vulns found): output/blacksql_results_YYYYMMDD_HHMMSS.json and .csv.

Examples (Rust)

Scan a specific parameter:

./target/release/blacksql -u "http://example.com/page.php?id=1" -p "id"

Scan with POST data:

./target/release/blacksql -u "http://example.com/login.php" --data "username=admin&password=test"

Use a proxy and higher level:

./target/release/blacksql -u "http://example.com/page.php?id=1" --proxy "http://127.0.0.1:8080" --level 3

Dump database info when vulnerable:

./target/release/blacksql -u "http://example.com/page.php?id=1" --dump

---

Legacy Python usage

cd legacy && python blacksql.py -u "http://example.com/page.php?id=1"

See the table above for the same options; -o is the log file path in both versions.

Disclaimer

This tool is intended for legal security testing and educational purposes only. Do not use it against any website or system without proper authorization. The author is not responsible for any misuse or damage caused by this tool.

License

blackSQL is open-source under the MIT License.