OWASP – SQLiX Project – SQL Injection Scanner

Your website & network are Hackable

SQLiX, coded in Perl, is a SQL Injection scanner, able to crawl, detect SQL injection vectors, identify the back-end database and grab function call/UDF results (even execute system commands for MS-SQL). The concepts in use are different than the one used in other SQL injection scanners. SQLiX is able to find normal and blind SQL injection vectors and doesn’t need to reverse engineer the original SQL request (using only function calls).

SQLiX is a SQL Injection scanner which attempts to fill the gap between what commercial software available on the market can do and what can really be done to detect and identify SQL injection.

Current injection methods used by commercial web assessment software are based on error generation or statement injections.

Error Generation

The error generation method is quite simple and is based on meta characters like single quotes or double quotes. By injecting these characters in the original SQL request, you generate a syntax error which could result in an SQL error message displayed in the HTTP reply. The main issue with this technique is the fact that it’s only based on pattern matching. There is no way to handle multiple languages or complex behaviors when the error message is filtered by the server-side scripts.

Statement Injection

The second method used is statement injection. Let’s look at an example:

The target URL

The scanner will try to compare the HTML content of the original request with the HTML content of

If the request (1) provides the same result as request (0) and request (2) doesn’t, the scanner will conclude that SQL injection is possible. This method works fine, but is very limited by the syntax of the original request. If the original request contains parentheses, store procedures or function calls, this method will rarely work. Worse, if the variable is used by multiple SQL requests, all with different syntaxes, there is no automatic way to make them all work simultaneously.

Another global issue concerning SQL injection is the fact that pen testers frequently conclude that a given SQL injection vulnerability can’t be exploited. By concluding this incorrect statement they are inviting their customers to not patch the vulnerability.

You can download here:


Documentation and examples are here:


Posted in: Database Hacking, Hacking Tools, Web Hacking

, , , , , , , ,

Recent in Database Hacking:
- BBQSQL – Blind SQL Injection Framework
- DBPwAudit – Database Password Auditing Tool
- VTech Hack – Over 7 Million Records Leaked (Children & Parents)

Related Posts:

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 77,377 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 54,557 views
- SQLBrute – SQL Injection Brute Force Tool - 41,588 views

3 Responses to OWASP – SQLiX Project – SQL Injection Scanner

  1. Sandeep Nain July 31, 2007 at 11:37 pm #

    nice tool…. just finished pen testing of a website using this tool and got the results as expected.

    works well with MySQL as well as PostgreSQL

    and offers a lot of command line switches to give you flexibility to choose the attack vectors depending on the target.

    Highly recommended…

  2. backbone August 1, 2007 at 3:39 am #

    darknet try and upload a pack with perl modules, because I have installed the newset active perl version and this won’t work…


  1. Persona Non Grata » links for 2007-05-31 - May 31, 2007

    […] OWASP – SQLiX Project – SQL Injection Scanner » Tool for testing SQL injection (tags: linux perl security sql tools)   […]