Sleep Stalker - A Time-Based SQL Injection Exploit Tool

This tool is designed to exploit time-based SQL injection vulnerabilities in web applications. It automates the process of extracting data from databases by leveraging time-delay responses from the target.

Demo

POC.mp4

Usage

Help

  python3 exploit.py -h

To Fetch Data from a table

  python3 exploit.py <target_url> -T <table_name>

Features

Automated Data Extraction:

Extracts database information like version, database names, table names and table data through time-based delays.

Customizable Payloads:

Modify SQL payloads to target different databases, adapting to varying schemas, table names, and column structures. This allows the tool to work across multiple web applications with different database designs.

Dynamic Query Building:

Easily modify the URL endpoints, parameters, or SQL queries within the script to target different web applications or pages.

Verbose Output:

Detailed output including fetched data such as table structures, column names, and content, presented in a clean, readable format using PrettyTable for easy analysis.

Limitations

This tool is currently tailored for a specific web application which is using PostgreSQL. However, it can be adapted to target other vulnerable web applications by modifying key elements such as URLs, vulnerable parameters, and payloads.

How to Adopt for Other Targets

While the tool is specific to one web app, it can be adapted for use on other applications with similar vulnerabilities by modifying the following elements:

1. Target URL:

Update the URL to the vulnerable endpoint of the web app you want to test.

2. Vulnerable Parameter:

Adjust the payload to the parameter that is susceptible to SQL injection (e.g., vid in the current setup).

3. Payloads:

Modify the SQL injection payloads based on the target web application's database schema (e.g., table names, columns, etc.), ensuring they are customized to the specific structure of the target.

4. Additional Changes as Per the Requirement:

Depending on the target application, further customizations might be needed. This could include modifying URL reachability function, handling specific headers, session management, authentication mechanisms, or even bypassing additional security layers like firewalls or WAFs etc.