VIPERMAP is an automated SQL injection vulnerability scanner that combines crawling capabilities with SQLMap integration to identify and test for SQL injection vulnerabilities across a domain.
__ _____ ____ _ _ _ ____ _ _______ ____ _ ___ ___
\ \ / /_ _| _ \| | | | / \ / ___| |/ / ____| _ \ / |/ _ \ / _ \
\ \ / / | || |_) | |_| | / _ \| | | ' /| _| | |_) | | | | | | | | |
\ V / | || __/| _ |/ ___ \ |___| . \| |___| _ < _| | |_| | |_| |
\_/ |___|_| |_| |_/_/ \_\____|_|\_\_____|_| \_(_)_|\___/ \___/
-
Automated URL Discovery: Uses multiple methods to find URLs with parameters:
- Wayback Machine archive via the tool or API
- Fallback crawling of common paths and parameters
- Link extraction from page content
-
Multi-threaded Operations: Performs URL checks and SQLMap scans in parallel to save time
-
Smart Filtering: Only processes URLs with query parameters and checks accessibility before testing
-
Dependency Management: Automatically checks for required tools and attempts to install waybackurls if missing
-
Randomized User-Agents: Uses different user agents to avoid detection or blocking
-
Enhanced SQLMap Integration: Configures SQLMap with optimized options for thorough testing
- Python 3.6+
- SQLMap
- Go (optional - for installing waybackurls)
The script requires the following Python packages:
requests
And the following external tools:
sqlmap (required)
waybackurls (optional - will attempt to install if Go is available)
- Clone or download this repository:
git clone https://github.com/viphacker-100/vipermap.git
cd vipermap
- Install required Python packages:
pip install -r requirements.txt
- Make the script executable:
chmod +x vipermap.py
- Install SQLMap if not already installed:
pip install sqlmap
- (Optional) Install Go to enable automatic waybackurls installation:
# Follow instructions at https://golang.org/doc/install
python vipermap.py --domain example.com
python vipermap.py --domain example.com --threads 10
--domain: Target domain to scan (e.g., example.com)--threads: Number of threads for parallel processing (default: 5 to 10) JSON Results Saving: Added--outputoption to save scan results to a JSON file SQLMap Output Directory: Added--output-diroption to save detailed SQLMap results Comprehensive Results Tracking: Now tracks and stores metadata about the scan including:
Scan date and time Total URLs found Accessible URLs Vulnerable URLs Detailed SQLMap results per URL
If you run the script without arguments, it will prompt you for input:
python vipermap.py
-
URL Discovery: The script first attempts to find URLs with parameters using:
- Wayback Machine archives (via waybackurls tool or API)
- Custom crawling of common paths
- HTML link extraction
-
URL Verification: Each discovered URL is checked to ensure it's accessible
-
SQL Injection Testing: SQLMap is run on each valid URL with optimized parameters:
- Random user agents
- Advanced tamper techniques
- Level 5 / Risk 3 settings
- Crawl depth of 2
- Custom SQL injection suffixes
[+] Starting SQL injection scan on example.com
[+] Using waybackurls to fetch target URLs...
[+] Found 53 URLs with parameters
[+] Checking HTTP status for URLs...
[+] Valid URL: https://example.com/product.php?id=123 (Status: 200)
[+] Valid URL: https://example.com/category.php?cat=electronics (Status: 200)
[+] Found 24 accessible URLs
Do you want to run SQLMap on 24 URLs? (y/n): y
[+] Starting SQLMap on 24 URLs...
[+] Running SQLMap on: https://example.com/product.php?id=123
[...]
This tool is for educational purposes and authorized security testing only. Always ensure you have permission before scanning any website or domain. Unauthorized scanning may be illegal in many jurisdictions and against the terms of service of many websites.
This project is licensed under the MIT License - see the LICENSE file for details.
- SQLMap Project: https://github.com/sqlmapproject/sqlmap
- tomnomnom's waybackurls: https://github.com/tomnomnom/waybackurls
- Internet Archive's Wayback Machine: https://archive.org/web/