Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
cd14a07
Merge pull request #1 from codewatchorg/master
pajswigger Jan 2, 2018
b74cdde
Merge branch 'master' of github.com:codewatchorg/sqlipy
pajswigger Jan 5, 2018
8fbbd9a
Merge pull request #2 from codewatchorg/master
pajswigger Jan 5, 2018
8b40f71
Merge branch 'master' of https://github.com/PortSwigger/sqli-py
pajswigger Jan 5, 2018
43a2215
Update description
pajswigger Jan 5, 2018
97c77fd
Merge branch 'master' of github.com:codewatchorg/sqlipy
pajswigger Jan 8, 2018
2d81e0b
Merge branch 'master' of github.com:codewatchorg/sqlipy
pajswigger Jun 22, 2018
237b131
Merge pull request #3 from codewatchorg/master
pajswigger Jun 22, 2018
07a5f03
Merge pull request #4 from codewatchorg/master
pajswigger Jun 25, 2018
1c69174
Merge branch 'master' of https://github.com/PortSwigger/sqli-py
pajswigger Jun 25, 2018
4097a3c
Merge pull request #5 from codewatchorg/master
pajswigger Sep 13, 2018
6dfe18a
Merge pull request #6 from codewatchorg/master
michael-eaton-portswigger Nov 7, 2019
e08e579
Merge
PortSwiggerSupport Mar 4, 2021
3906184
Merge branch 'codewatchorg-master'
PortSwiggerSupport Mar 4, 2021
72c26c1
Manifest update
PortSwiggerSupport Mar 4, 2021
987ad94
Merge pull request #8 from codewatchorg/master
Hannah-PortSwigger Nov 23, 2022
be7ec68
Merge pull request #9 from codewatchorg/master
Hannah-PortSwigger Nov 23, 2022
c3d44ce
Merge pull request #10 from codewatchorg/master
Hannah-PortSwigger Dec 8, 2022
eeadae3
BApp Store update
PortSwiggerSupport Dec 20, 2022
98880c3
Merge pull request #11 from codewatchorg/master
Hannah-PortSwigger May 9, 2023
203ef7f
BApp Store update v0.8.5
PortSwiggerSupport Jun 8, 2023
3d91f1f
Merge.
Hannah-PortSwigger May 21, 2025
6c90d52
Merge branch 'codewatchorg-master'
Hannah-PortSwigger May 21, 2025
1a9c1a4
BApp Store update v0.8.6
Hannah-PortSwigger May 23, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 17 additions & 18 deletions BappDescription.html
Original file line number Diff line number Diff line change
@@ -1,23 +1,22 @@
<p>This extension integrates Burp Suite with SQLMap.</p>
<p>SQLiPy integrates SQLMap using its API, enabling SQL injection scans directly within Burp Suite. The plugin connects to a running instance of the SQLMap API server to perform scans on requests.</p>

<p>Requirements:</p>
<h2>Features</h2>
<ul>
<li>Jython 2.7 beta, due to the use of json.</li>
<li>Java 1.7 or later (the beta version of Jython 2.7 requires this).</li>
<li>A running instance of the SQLMap API server.</li>
<li>Integrates SQLMap API for automated SQL injection scanning.</li>
<li>Option to manually start the SQLMap API server or connect to an existing one.</li>
<li>Initiates scans by right-clicking requests in the "Target" or "Proxy" tabs.</li>
<li>Displays scan results in the "Scanner Results" tab if vulnerabilities are detected.</li>
</ul>
<p>SQLMap comes with a RESTful based server that will execute SQLMap scans. You can manually start the server
with: </p>
<pre> python sqlmapapi.py -s -H &lt;ip&gt; -p &lt;port&gt;
</pre>
<p>Alternatively, you can use the SQLMap API tab to select the IP/Port on which to run, as well as the path to python and sqlmapapi.py on your system.

</p>
<p>Once the SQLMap API is running, you just need to right-click in the 'Request'
sub tab of either the Target or Proxy main tabs and choose 'SQLiPy Scan' from
the context menu.
<h2>Usage</h2>
<ol>
<li>Start the SQLMap API server manually with the following command:<br>
<pre><code class="Code">python sqlmapapi.py -s -H &lt;ip&gt; -p &lt;port&gt;</code></pre>
</li>
<li>Alternatively, use the "SQLMap API" tab to select the IP/Port and provide the path to your <code class="InlineCode">sqlmapapi.py</code> and Python installations.</li>
<li>Once the SQLMap API is active, right-click a request in the "Request" sub-tab of the "Target" or "Proxy" tabs and select "SQLiPy Scan".</li>
<li>The request details will populate the SQLMap Scanner tab. Click the "Start Scan" button to initiate the scan.</li>
<li>If the page is vulnerable to SQL injection, the plugin will poll the results and add them to the "Scanner Results" tab.</li>
</ol>

This will populate the SQLMap Scanner tab with information about that request. Clicking the 'Start Scan' button will execute a scan.

If the page is vulnerable to SQL injection, then these will be added to the Scanner Results tab.
</p>
<p><strong>Note:</strong> Jython 2.7-2.7.2 is supported. DO NOT USE Jython 2.7.3, as it has a bug that will cause the extension to fail.<p>
4 changes: 3 additions & 1 deletion BappManifest.bmf
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,11 @@ ExtensionType: 2
Name: SQLiPy Sqlmap Integration
RepoName: sqli-py
ScreenVersion: 0.8.6
SerialVersion: 19
SerialVersion: 24
MinPlatformVersion: 0
ProOnly: False
Author: Josh Berry @ CodeWatch
ShortDescription: Initiates SQLMap scans directly from within Burp.
EntryPoint: SQLiPy.py
BuildCommand:
SupportedProducts: Pro, Community