asqli 0.1.0

Async, parallel SQL injection scanner with DBMS-aware blind inference.

asqli — Async SQL Injector

A high-throughput SQL injection scanner built on asyncio + aiohttp.

Install

pip install git+https://github.com/sarperavci/asqli.git

Usage

asqli -u 'http://target/vuln.php?id=1' --batch --dump
asqli -u 'http://target/login' --data 'user=admin&pass=x' --level 3 --risk 3
asqli -r request.txt -p id --technique=BT -c 16

Common flags:

Flag	Meaning
-u URL	Target URL
-r FILE	Burp/ZAP-style raw request file
--data BODY	POST body
-p NAME[,NAME…]	Restrict testing to these parameters
--skip NAME[,…]	Skip these parameters
--level N --risk N	Test breadth/aggressiveness (1–5 / 1–3)
--technique=BEUSTQ	Subset of B/E/U/S/T/Q techniques to try
--tamper SCRIPT[,…]	Apply tamper scripts
-c N --concurrency N	Total concurrent workers (default: 0 = unlimited)
--max N	Max concurrent probes per query / per parameter (default: 100)
--per-host N	Max concurrent requests per host (default: 32)
--dbs --tables --columns --dump	Enumerate / dump
-D NAME -T NAME	Restrict to a specific database / table
--banner --current-user --current-db --hostname	Pull a single fact
--proxy URL	HTTP/SOCKS proxy
--random-agent / --no-random-agent	Rotate UAs per request via UAForge (default: on)
--batch	Non-interactive mode
-v 0..6	Verbosity (3=payloads, 4=traffic-out, 5=traffic-in)

Legal

For authorised security testing only.