Skip to content

Commit 157c0e3

Browse files
vizzdoomvizzdoom
committed
v.20250612
1 parent 454195f commit 157c0e3

File tree

5 files changed

+989
-174
lines changed

5 files changed

+989
-174
lines changed

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
1-
todo.md
1+
todo.md
2+
.vs/

‎README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,6 @@
1-
# sqlmap-command-builder
1+
# SQLMap Command Builder
2+
3+
## Project website: https://vizzdoom.github.io/sqlmap-command-builder/
4+
5+
Interactive command line generator for conducting advanced SQLMap pentests.
6+
This project works locally with pure HTML/JS/CSS (no data exchanged to any server).

‎app.js‎

Lines changed: 146 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -149,8 +149,6 @@ class SQLMapGenerator {
149149
}
150150
document.getElementById('verbose-help').textContent = verboseHelp;
151151
});
152-
153-
154152
}
155153

156154
getCurrentConfig() {
@@ -180,9 +178,6 @@ class SQLMapGenerator {
180178
if (googleDork) config['-g'] = googleDork;
181179

182180
// Connection options
183-
const forceSsl = document.getElementById('forceSsl').checked;
184-
if (forceSsl) config['--force-ssl'] = forceSsl;
185-
186181
const timeout = document.getElementById('timeout').value;
187182
if (timeout && timeout != 30) config['--timeout'] = timeout;
188183

@@ -192,6 +187,18 @@ class SQLMapGenerator {
192187
const threads = document.getElementById('threads').value;
193188
if (threads && threads > 1) config['--threads'] = threads;
194189

190+
const forceSsl = document.getElementById('forceSsl').checked;
191+
if (forceSsl) config['--force-ssl'] = forceSsl;
192+
193+
const keepAlive = document.getElementById('keepAlive').checked;
194+
if (keepAlive) config['--keep-alive'] = keepAlive;
195+
196+
const nullConnection = document.getElementById('nullConnection').checked;
197+
if (nullConnection) config['--null-connection'] = nullConnection;
198+
199+
const http2 = document.getElementById('http2').checked;
200+
if (http2) config['--http2'] = http2;
201+
195202
const proxy = document.getElementById('proxy').value.trim();
196203
if (proxy) config['--proxy'] = proxy;
197204

@@ -225,7 +232,6 @@ class SQLMapGenerator {
225232
const host = document.getElementById('host').value.trim();
226233
if (host) config['--host'] = host;
227234

228-
// Request options
229235
const userAgent = document.getElementById('userAgent').value;
230236
if (userAgent && userAgent === 'random') {
231237
config['--random-agent'] = true;
@@ -290,11 +296,17 @@ class SQLMapGenerator {
290296
if (csrfRetries && csrfRetries > 0) config['--csrf-retries'] = csrfRetries;
291297

292298
// Injection options
293-
const testParams = document.getElementById('testParams').value.trim();
294-
if (testParams) config['-p'] = testParams;
299+
const paramTest = document.getElementById('paramTest').value.trim();
300+
if (paramTest) config['-p'] = paramTest;
301+
302+
const paramSkip = document.getElementById('paramSkip').value.trim();
303+
if (paramSkip) config['--skip'] = paramSkip;
304+
305+
const paramExclude = document.getElementById('paramExclude').value.trim();
306+
if (paramExclude) config['--param-exclude'] = paramExclude;
295307

296-
const skipParams = document.getElementById('skipParams').value.trim();
297-
if (skipParams) config['--skip'] = skipParams;
308+
const paramFilter = document.getElementById('paramFilter').value.trim();
309+
if (paramFilter) config['--param-filter'] = paramFilter;
298310

299311
const level = document.getElementById('level').value;
300312
if (level > 1) config['--level'] = level;
@@ -307,6 +319,15 @@ class SQLMapGenerator {
307319

308320
const os = document.getElementById('os').value;
309321
if (os) config['--os'] = os;
322+
323+
const prefix = document.getElementById('prefix').value.trim();
324+
if (prefix) config['--prefix'] = prefix;
325+
326+
const suffix = document.getElementById('suffix').value.trim();
327+
if (suffix) config['--suffix'] = suffix;
328+
329+
const secondUrl = document.getElementById('secondUrl').value.trim();
330+
if (secondUrl) config['--second-url'] = secondUrl;
310331

311332
// Techniques
312333
const techniques = [];
@@ -317,8 +338,102 @@ class SQLMapGenerator {
317338
if (document.getElementById('techT').checked) techniques.push('T');
318339
if (document.getElementById('techQ').checked) techniques.push('Q');
319340
if (techniques.length > 0) config['--technique'] = techniques.join('');
320-
321-
// Detection options
341+
342+
const tamperScripts = [];
343+
if (document.getElementById('tamperscript-0eunion').checked) tamperScripts.push('0eunion');
344+
if (document.getElementById('tamperscript-apostrophemask').checked) tamperScripts.push('apostrophemask');
345+
if (document.getElementById('tamperscript-apostrophenullencode').checked) tamperScripts.push('apostrophenullencode');
346+
if (document.getElementById('tamperscript-appendnullbyte').checked) tamperScripts.push('appendnullbyte');
347+
if (document.getElementById('tamperscript-base64encode').checked) tamperScripts.push('base64encode');
348+
if (document.getElementById('tamperscript-between').checked) tamperScripts.push('between');
349+
if (document.getElementById('tamperscript-binary').checked) tamperScripts.push('binary');
350+
if (document.getElementById('tamperscript-bluecoat').checked) tamperScripts.push('bluecoat');
351+
if (document.getElementById('tamperscript-chardoubleencode').checked) tamperScripts.push('chardoubleencode');
352+
if (document.getElementById('tamperscript-charencode').checked) tamperScripts.push('charencode');
353+
if (document.getElementById('tamperscript-charunicodeencode').checked) tamperScripts.push('charunicodeencode');
354+
if (document.getElementById('tamperscript-charunicodeescape').checked) tamperScripts.push('charunicodeescape');
355+
if (document.getElementById('tamperscript-commalesslimit').checked) tamperScripts.push('commalesslimit');
356+
if (document.getElementById('tamperscript-commalessmid').checked) tamperScripts.push('commalessmid');
357+
if (document.getElementById('tamperscript-commentbeforeparentheses').checked) tamperScripts.push('commentbeforeparentheses');
358+
if (document.getElementById('tamperscript-concat2concatws').checked) tamperScripts.push('concat2concatws');
359+
if (document.getElementById('tamperscript-decentities').checked) tamperScripts.push('decentities');
360+
if (document.getElementById('tamperscript-dunion').checked) tamperScripts.push('dunion');
361+
if (document.getElementById('tamperscript-equaltolike').checked) tamperScripts.push('equaltolike');
362+
if (document.getElementById('tamperscript-equaltorlike').checked) tamperScripts.push('equaltorlike');
363+
if (document.getElementById('tamperscript-escapequotes').checked) tamperScripts.push('escapequotes');
364+
if (document.getElementById('tamperscript-greatest').checked) tamperScripts.push('greatest');
365+
if (document.getElementById('tamperscript-halfversionedmorekeywords').checked) tamperScripts.push('halfversionedmorekeywords');
366+
if (document.getElementById('tamperscript-hex2char').checked) tamperScripts.push('hex2char');
367+
if (document.getElementById('tamperscript-hexentities').checked) tamperScripts.push('hexentities');
368+
if (document.getElementById('tamperscript-htmlencode').checked) tamperScripts.push('htmlencode');
369+
if (document.getElementById('tamperscript-if2case').checked) tamperScripts.push('if2case');
370+
if (document.getElementById('tamperscript-ifnull2casewhenisnull').checked) tamperScripts.push('ifnull2casewhenisnull');
371+
if (document.getElementById('tamperscript-ifnull2ifisnull').checked) tamperScripts.push('ifnull2ifisnull');
372+
if (document.getElementById('tamperscript-informationschemacomment').checked) tamperScripts.push('informationschemacomment');
373+
if (document.getElementById('tamperscript-least').checked) tamperScripts.push('least');
374+
if (document.getElementById('tamperscript-lowercase').checked) tamperScripts.push('lowercase');
375+
if (document.getElementById('tamperscript-luanginx').checked) tamperScripts.push('luanginx');
376+
if (document.getElementById('tamperscript-luanginxmore').checked) tamperScripts.push('luanginxmore');
377+
if (document.getElementById('tamperscript-misunion').checked) tamperScripts.push('misunion');
378+
if (document.getElementById('tamperscript-modsecurityversioned').checked) tamperScripts.push('modsecurityversioned');
379+
if (document.getElementById('tamperscript-modsecurityzeroversioned').checked) tamperScripts.push('modsecurityzeroversioned');
380+
if (document.getElementById('tamperscript-multiplespaces').checked) tamperScripts.push('multiplespaces');
381+
if (document.getElementById('tamperscript-ord2ascii').checked) tamperScripts.push('ord2ascii');
382+
if (document.getElementById('tamperscript-overlongutf8').checked) tamperScripts.push('overlongutf8');
383+
if (document.getElementById('tamperscript-overlongutf8more').checked) tamperScripts.push('overlongutf8more');
384+
if (document.getElementById('tamperscript-percentage').checked) tamperScripts.push('percentage');
385+
if (document.getElementById('tamperscript-plus2concat').checked) tamperScripts.push('plus2concat');
386+
if (document.getElementById('tamperscript-plus2fnconcat').checked) tamperScripts.push('plus2fnconcat');
387+
if (document.getElementById('tamperscript-randomcase').checked) tamperScripts.push('randomcase');
388+
if (document.getElementById('tamperscript-randomcomments').checked) tamperScripts.push('randomcomments');
389+
if (document.getElementById('tamperscript-schemasplit').checked) tamperScripts.push('schemasplit');
390+
if (document.getElementById('tamperscript-scientific').checked) tamperScripts.push('scientific');
391+
if (document.getElementById('tamperscript-sleep2getlock').checked) tamperScripts.push('sleep2getlock');
392+
if (document.getElementById('tamperscript-sp_password').checked) tamperScripts.push('sp_password');
393+
if (document.getElementById('tamperscript-space2comment').checked) tamperScripts.push('space2comment');
394+
if (document.getElementById('tamperscript-space2dash').checked) tamperScripts.push('space2dash');
395+
if (document.getElementById('tamperscript-space2hash').checked) tamperScripts.push('space2hash');
396+
if (document.getElementById('tamperscript-space2morecomment').checked) tamperScripts.push('space2morecomment');
397+
if (document.getElementById('tamperscript-space2morehash').checked) tamperScripts.push('space2morehash');
398+
if (document.getElementById('tamperscript-space2mssqlblank').checked) tamperScripts.push('space2mssqlblank');
399+
if (document.getElementById('tamperscript-space2mssqlhash').checked) tamperScripts.push('space2mssqlhash');
400+
if (document.getElementById('tamperscript-space2mysqlblank').checked) tamperScripts.push('space2mysqlblank');
401+
if (document.getElementById('tamperscript-space2mysqldash').checked) tamperScripts.push('space2mysqldash');
402+
if (document.getElementById('tamperscript-space2plus').checked) tamperScripts.push('space2plus');
403+
if (document.getElementById('tamperscript-space2randomblank').checked) tamperScripts.push('space2randomblank');
404+
if (document.getElementById('tamperscript-substring2leftright').checked) tamperScripts.push('substring2leftright');
405+
if (document.getElementById('tamperscript-symboliclogical').checked) tamperScripts.push('symboliclogical');
406+
if (document.getElementById('tamperscript-unionalltounion').checked) tamperScripts.push('unionalltounion');
407+
if (document.getElementById('tamperscript-unmagicquotes').checked) tamperScripts.push('unmagicquotes');
408+
if (document.getElementById('tamperscript-uppercase').checked) tamperScripts.push('uppercase');
409+
if (document.getElementById('tamperscript-varnish').checked) tamperScripts.push('varnish');
410+
if (document.getElementById('tamperscript-versionedkeywords').checked) tamperScripts.push('versionedkeywords');
411+
if (document.getElementById('tamperscript-versionedmorekeywords').checked) tamperScripts.push('versionedmorekeywords');
412+
if (document.getElementById('tamperscript-xforwardedfor').checked) tamperScripts.push('xforwardedfor');
413+
414+
const tamper = document.getElementById('tamper');
415+
if (tamperScripts.length > 0) tamper.value = tamperScripts.join(',');
416+
if (tamper.value.trim()) config['--tamper'] = tamper.value.trim();
417+
418+
const invalidBignum = document.getElementById('invalidBignum').checked;
419+
if (invalidBignum) config['--invalid-bignum'] = invalidBignum;
420+
421+
const invalidLogical = document.getElementById('invalidLogical').checked;
422+
if (invalidLogical) config['--invalid-logical'] = invalidLogical;
423+
424+
const invalidString = document.getElementById('invalidString').checked;
425+
if (invalidString) config['--invalid-string'] = invalidString;
426+
427+
const noCast = document.getElementById('noCast').checked;
428+
if (noCast) config['--no-cast'] = noCast;
429+
430+
const noEscape = document.getElementById('noEscape').checked;
431+
if (noEscape) config['--no-escape'] = noEscape;
432+
433+
const predictOutput = document.getElementById('predictOutput').checked;
434+
if (predictOutput) config['--predict-output'] = predictOutput;
435+
436+
// SQLMAP options
322437
if (document.getElementById('batch').checked) config['--batch'] = true;
323438

324439
const verbose = document.getElementById('verbose').value;
@@ -329,10 +444,7 @@ class SQLMapGenerator {
329444

330445
if (document.getElementById('parseErrors').checked) config['--parse-errors'] = true;
331446

332-
const testFilter = document.getElementById('testFilter').value.trim();
333-
if (testFilter) config['--test-filter'] = testFilter;
334-
335-
// Enumeration options
447+
// Post-exploitation options
336448
if (document.getElementById('currentUser').checked) config['--current-user'] = true;
337449
if (document.getElementById('currentDb').checked) config['--current-db'] = true;
338450
if (document.getElementById('dbs').checked) config['--dbs'] = true;
@@ -350,27 +462,6 @@ class SQLMapGenerator {
350462
const column = document.getElementById('column').value.trim();
351463
if (column) config['-C'] = column;
352464

353-
// Optimization options
354-
355-
356-
if (document.getElementById('keepAlive').checked) config['--keep-alive'] = true;
357-
if (document.getElementById('nullConnection').checked) config['--null-connection'] = true;
358-
if (document.getElementById('predictOutput').checked) config['--predict-output'] = true;
359-
if (document.getElementById('optimize').checked) config['-o'] = true;
360-
361-
// Advanced options
362-
const tamper = document.getElementById('tamper').value.trim();
363-
if (tamper) config['--tamper'] = tamper;
364-
365-
const prefix = document.getElementById('prefix').value.trim();
366-
if (prefix) config['--prefix'] = prefix;
367-
368-
const suffix = document.getElementById('suffix').value.trim();
369-
if (suffix) config['--suffix'] = suffix;
370-
371-
const secondUrl = document.getElementById('secondUrl').value.trim();
372-
if (secondUrl) config['--second-url'] = secondUrl;
373-
374465
return config;
375466
}
376467

@@ -381,18 +472,19 @@ class SQLMapGenerator {
381472
// Order of parameters for better readability
382473
const paramOrder = [
383474
'-u', '-d', '-r', '-m', '-l', '--scope', '-g',
384-
'--force-ssl', '--timeout', '--delay', '--threads',
475+
'--timeout', '--delay', '--threads',
385476
'--proxy', '--proxy-cred', '--proxy-file', '--proxy-freq', '--ignore-proxy',
477+
'--force-ssl', '--keep-alive', '--null-connection', '--http2',
386478
'--method', '--data', '--param-del',
387479
'--host', '-A', '--mobile', '--random-agent', "--referer", "-H",
388480
'--cookie', '--cookie-del', '--live-cookies', '--load-cookies', '--drop-set-cookie',
389481
'--auth-type', '--auth-cred', '--auth-file',
390482
'--csrf-token', '--csrf-url', '--csrf-method', '--csrf-retries',
391-
'-p', '--skip', '--level', '--risk', '--dbms', '--os', '--technique',
483+
'-p', '--skip', '--param-exclude', '--param-filter', '--level', '--risk', '--dbms', '--os',
484+
'--technique', '--invalid-bignum', '--invalid-logical', '--invalid-string', '--no-cast', '--no-escape', '--predict-output',
392485
'--batch', '-v', '-t', '--parse-errors', '--test-filter',
393486
'--current-user', '--current-db', '--dbs', '--tables', '--columns', '--schema', '--dump-all',
394-
'-D', '-T', '-C',
395-
'--keep-alive', '--null-connection', '--predict-output', '-o',
487+
'-D', '-T', '-C', '-o',
396488
'--tamper', '--prefix', '--suffix', '--csrf-token', '--csrf-url', '--second-url'
397489
];
398490

@@ -663,13 +755,22 @@ class SQLMapGenerator {
663755
'--csrf-url': 'csrfUrl',
664756
'--csrf-method': 'csrfMethod',
665757
'--csrf-retries': 'csrfRetries',
666-
'-p': 'testParams',
667-
'--skip': 'skipParams',
758+
'-p': 'paramTest',
759+
'--skip': 'paramSkip',
760+
'--param-exclude': 'paramExclude',
761+
'--param-filter': 'paramFilter',
668762
'--level': 'level',
669763
'--risk': 'risk',
670764
'--dbms': 'dbms',
671765
'--os': 'os',
672766
'--technique': 'technique',
767+
'--invalid-bignum': 'invalidBignum',
768+
'--invalid-logical': 'invalidLogical',
769+
'--invalid-string': 'invalidString',
770+
'--no-cast': 'noCast',
771+
'--no-escape': 'noEscape',
772+
'--predict-output':'predictOutput',
773+
'--keep-alive': 'keepAlive',
673774
'--batch': 'batch',
674775
'-v': 'verbose',
675776
'-t': 'trafficFile',
@@ -685,9 +786,7 @@ class SQLMapGenerator {
685786
'-D': 'database',
686787
'-T': 'table',
687788
'-C': 'column',
688-
'--keep-alive': 'keepAlive',
689789
'--null-connection': 'nullConnection',
690-
'--predict-output': 'predictOutput',
691790
'-o': 'optimize',
692791
'--tamper': 'tamper',
693792
'--prefix': 'prefix',
@@ -711,7 +810,8 @@ class SQLMapGenerator {
711810
techElement.checked = value.includes(tech);
712811
}
713812
});
714-
} else {
813+
}
814+
else {
715815
element.value = value;
716816

717817
// Update slider displays

0 commit comments

Comments
 (0)