BreachSQL

Fast SQL injection scanner with built-in exploitation — detect and extract in one command, across all major backends, with WAF evasion baked in. A single static Go binary, no runtime to install.

git clone https://github.com/CommonHuman-Lab/breachsql.git
cd breachsql
go build ./cmd/breachsql

# Scan, exploit, and dump everything
./breachsql --exploit "http://127.0.0.1:17476/challenges/my1/secrets?id=1"

Point it at a target. Get findings. Drop it in a pipeline.

Why BreachSQL?

• Faster — binary-search boolean/time extraction, marker-substitution UNION extraction, concurrent surface probing
• Detect → exploit in one pass — --exploit binary-searches or UNION-extracts version/user/db/tables from a confirmed finding and dumps every discovered table; --dump TABLE targets a single one
• chcrawl-native discovery — BFS crawling, form discovery, JS-endpoint mining, headless-Chromium rendering (--browser-crawl), and OpenAPI/Swagger spec import (--openapi), all from the same engine chcrawl uses standalone
• Pipeline-native — structured JSON (--json)/JSONL (--jsonl) output, clean exit codes, no interactive prompts unless you run it with no target at all
• Single static binary — go build, copy it anywhere, no runtime or virtual environment to manage

Quick Start

# GET parameter
breachsql "https://target.com/item?id=1"

# POST form
breachsql --data "username=admin&password=x" "https://target.com/login"

# JSON body
breachsql --data '{"user_id": 1}' "https://target.com/api/user"

# Cookie injection
breachsql --cookie "session_id=abc" --cookie-params session_id "https://target.com/profile"

# Path parameter
breachsql --path-params id "https://target.com/item/1"

# Time-blind with custom threshold
breachsql --technique T --time-threshold 3 "https://target.com/search?name=x"

# Specific backend and technique
breachsql --dbms mysql --technique E "https://target.com/users?id=1"

# Exploit: dump every table
breachsql --exploit "https://target.com/users?id=1"

# Exploit, and save results to a custom output stem
breachsql --exploit --output results/target "https://target.com/users?id=1"

# Stream JSON to stdout (pipeline-friendly)
breachsql --json "https://target.com/users?id=1" | jq .

# Save plain-text summary separately
breachsql --text summary.txt "https://target.com/users?id=1"

# Full multi-technique scan
breachsql --dbms mysql --technique EBTUS --level 2 --risk 2 "https://target.com/report?id=1"

# Authenticate before scanning
breachsql --login-url "https://target.com/login" \
  --login-user admin --login-pass secret \
  "https://target.com/app/search?q=test"

# Import all endpoints from an OpenAPI / Swagger spec
breachsql --openapi https://target.com/openapi.json "https://target.com/"

# Discover JS-rendered endpoints first, then scan everything
breachsql --browser-crawl --level 2 "https://target.com/"

# Scan a whole list of targets from a file (blank lines and # comments skipped)
breachsql --url-list targets.txt

Techniques

Flag	Technique	Description
E	Error-based	Database errors leak schema/data via malformed syntax
B	Boolean-blind	True/false response differences reveal data bit by bit
T	Time-blind	SLEEP() / pg_sleep() / WAITFOR DELAY / randomblob() timing confirms injection
U	UNION-based	Column-count probing + data extraction via UNION SELECT
S	Stacked	Semicolon-delimited second statement injection (opt-in — off by default)
O	Out-of-band	Fire-and-forget payloads confirmed via your own callback server (--oob URL)

Combine with --technique EBTUO (the default) or add S for stacked queries too.

Options

Option	Default	Description
(positional)	—	Target URL
--url-list FILE	—	File of target URLs, one per line (# comments and blank lines skipped)
--stdin	—	Read a chcrawl -output - JSONL discovery stream from stdin instead of crawling
--no-crawl	—	Skip chcrawl entirely; test only each target's own query params
--dbms	auto	Target backend: mysql, mariadb, postgres, sqlite, mssql, oracle
--technique	EBTUO	Techniques to run (any combo of E B T U S O)
--level	1	Scan thoroughness: 1 = fast, 2 = also probe numeric path segments, 3 = deep
--risk	1	Payload aggression: 1 = safe, 2 = moderate, 3 = aggressive
--concurrency	5	Concurrent detection workers
--crawl-concurrency	20	Concurrent in-flight requests during the crawl phase
--time-threshold	4	Seconds delta to flag a time-based hit
--max-union-cols	20	Max columns to probe for UNION-based detection
--oob URL	—	Out-of-band callback URL for OOB detection
--data DATA	—	Raw POST body — form-encoded or a JSON object
--cookie	—	Cookie string: name=val; name2=val2
--cookie-params	—	Comma-separated cookie names to inject
--header-params	—	Comma-separated HTTP header names to inject
--path-params	—	Comma-separated path segment names to inject (auto-detected from :name/{name} if omitted)
--header "Name: Value"	—	Extra request header (repeatable)
--second-url URL	—	Read the SQLi response from this URL instead of the injected request's own response
--exclude PATTERN	—	Regex of URLs to skip (repeatable) — applies to both --url-list targets and crawl-discovered URLs
--max-pages	100	Max pages to crawl
--max-depth	3	Max crawl depth
--delay	0	Fixed delay before every request, crawl and injection alike
--proxy	—	HTTP proxy URL
--timeout	15s	Per-request timeout
--login-url	—	Login form URL — authenticates before crawling and scanning
--login-user / --login-pass	—	Credentials for --login-url
--login-user-field / --login-pass-field	username/password	Form field names for --login-url
--openapi	—	OpenAPI/Swagger spec file or URL — imports endpoints to scan
--base-url	—	Origin override for --openapi
--browser-crawl	—	Headless-Chromium endpoint discovery for JS-rendered pages
--exploit	—	Extract version/user/db/tables from a confirmed finding (implies --dump-all)
--dump TABLE	—	Dump one table's rows (requires a UNION-based finding)
--dump-all	—	Dump every table found
--json	—	Print each target's full result as its own JSON document
--jsonl	—	Print one JSON finding per line, across all targets
--output STEM	—	Write <stem>.json/<stem>.txt (and <stem>_dump.json if any tables were dumped)
--text FILE	—	Write the plain-text summary to this exact file
--report-html FILE	—	Write a self-contained HTML report covering every target scanned
--quiet	—	Suppress the terminal summary
--verbose	—	Print phase-by-phase scan progress to stderr

Running breachsql with no target at all (and no --stdin) drops into an interactive prompt walking through every option above.

---

Legal & Ethical Use

Only run BreachSQL against applications you own or have explicit written authorization to test. Authorized use includes penetration testing engagements, bug bounty programs within defined scope, and CTF competitions.

--exploit, --dump, and --dump-all extract live database content — only use them where data extraction is explicitly permitted by your engagement scope.

The authors accept no liability for unauthorized or illegal use.

License

Licensed under the AGPLv3. You are free to use, modify, and distribute this software. If you run it as a service or distribute it, the source must remain open.

For commercial licensing, contact the author.