# sqlmap_gui

**Repository Path**: wclnb/sqlmap_gui

## Basic Information

- **Project Name**: sqlmap_gui
- **Description**: No description available
- **Primary Language**: Unknown
- **License**: Apache-2.0
- **Default Branch**: main
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2025-12-23
- **Last Updated**: 2025-12-23

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# SQLMap GUI

An intuitive, cross-platform graphical user interface for [SQLMap](https://github.com/sqlmapproject/sqlmap) built with PyQt6. It simplifies SQL injection testing by letting security testers configure and launch scans through a point-and-click interface instead of memorizing long command-line flags.

![image-20250804162011231](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804162016704.png)

---

## Features

| Category                        | Highlights                                                   |
| ------------------------------- | ------------------------------------------------------------ |
| **Intuitive GUI**               | Tabbed layout that groups SQLMap options into logical sections, making the tool approachable even for first-time users. |
| **Basic Configuration**         | Quickly set target URL, HTTP request file, POST data, cookies, headers, injection technique, DBMS type, risk/level, and enumeration scope (databases, tables, columns, data). |
| **Advanced Tweaks**             | Fine-tune threads, timeouts, delays, retries, verbosity, WAF detection/bypass, Tor, OS fingerprinting, proxy chains, and custom parameters. |
| **Tamper Scripts**              | Auto-detects every tamper script inside `sqlmap/tamper/`, lets you search, read detailed descriptions, and enable multiple scripts simultaneously to evade WAF/IPS. |
| **HTTP Request Editor**         | Browse, inspect, and edit raw HTTP request files directly in the GUI; built-in syntax checker guarantees valid format before execution. |
| **Command Preview & Execution** | Shows the exact SQLMap command that will be run. For simple GET requests the GUI can launch SQLMap internally and stream live output; for POST or complex cases it generates a copy-paste command for the terminal to avoid compatibility issues. |
| **Results & Export**            | Real-time, syntax-highlighted console output inside the GUI. Save results as plain text or styled HTML, and archive the generated command for reproducibility. |
| **Built-in Manual**             | Embedded copy of the official SQLMap user guide for quick reference without leaving the application. |

---

## Screenshots

1. **Basic Options** – Core target and injection settings. 
   
2. **Advanced Options** – Performance, detection, and networking tweaks. 
   
3. **Tamper Scripts** – Search, preview, and select evasion scripts.  
   
4. **Run & Results** – Live console output and export buttons.  

---

## Installation

### Prerequisites

* **Python 3.6+**
* **SQLMap**
  Recommended: clone the latest dev branch  
  
  ```bash
  git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
  ```
* **PyQt6**  
  ```bash
  pip install PyQt6
  ```

### Steps

1. **Download the GUI**
   Place `sqlmap_gui.py` and `gui_settings.py` in the **root** of the SQLMap directory (where `sqlmap.py` lives).

2. **Verify SQLMap**
   
   ```bash
   cd sqlmap-dev
   python sqlmap.py --version
   ```
   
3. **Launch the GUI**
   
   ```bash
   python sqlmap_gui.py
   ```

---

## Usage Walk-through

### 1. Choose Injection Type

| GET Injection                | POST / File-based Injection                                  |
| ---------------------------- | ------------------------------------------------------------ |
| Simply enter the target URL. | Load a Burp/ZAP request file or paste raw HTTP text; edit inline if needed. The GUI warns and offers auto-fixes for malformed requests. |

![image-20250804163300410](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804163300442.png)  
![image-20250804163459669](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804163459706.png)

### 2. Configure Basic Options
Select technique, DBMS, risk/level, and what to enumerate.

![image-20250804174008066](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804174008102.png)

### 3. (Optional) Advanced Tweaks
Randomize UA, add delays, route traffic through Tor or a proxy, etc.

![image-20250804174606384](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804174606406.png)

### 4. (Optional) Tamper Scripts
Left-click a script to read its description; tick boxes on the right to enable.

![image-20250804174742375](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804174742404.png)

### 5. Run SQLMap
Click **“Run SQLMap”**.
- Simple GET → runs inside the GUI with live output.  
- Complex/POST → copies the full command to your clipboard for terminal use.

![image-20250804175057030](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804175057057.png)

### 6. Save Results
Export console output as `.txt` or styled `.html`, or archive the exact command for later.

![image-20250804175242899](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804175242924.png)

![image-20250804175348915](https://dikkksi-wiki-pic.oss-cn-chengdu.aliyuncs.com/wiki_img_2/20250804175348938.png)

---

## Notes & Best Practices

* **Legality**
  Only use this tool on systems you **own** or have **explicit written permission** to test. Unauthorized use is illegal and unethical.
* **Compatibility**
  For intricate HTTP requests (especially POST), the GUI intentionally delegates execution to the terminal to ensure stability.
* **Environment**
  When the GUI spawns SQLMap it sets `SQLMAP_NOCOLOR=1` and other flags to optimize parsing of the output.

---

## File Layout

```
sqlmap-dev/
├── sqlmap.py
├── sqlmap_gui.py      ← main GUI logic
├── gui_settings.py    ← themes, fonts, help text
└── tamper/            ← tamper scripts auto-loaded by GUI
```

---

## Disclaimer

This project is intended for **authorized security testing and research only**. Users bear full responsibility for compliance with applicable laws. The authors disclaim any liability for misuse or damages arising from this software.

---

## License

* **GUI** – Apache License 2.0  
* **SQLMap** – GPLv2 or later

---

## Acknowledgments

Huge thanks to the maintainers and contributors of the amazing open-source project [sqlmapproject/sqlmap](https://github.com/sqlmapproject/sqlmap).