diff --git a/PLUGINS.md b/PLUGINS.md index 8e8505732..767e1aec2 100644 --- a/PLUGINS.md +++ b/PLUGINS.md @@ -80,9 +80,9 @@ Only run scans against systems you own or are explicitly authorized to assess. | Sitemap Generator | `sitemap_gen` | `robots` | `intrusive` | `katana` | Build complete XML sitemaps by autonomously parsing targets. | | Sniper: Auto-Exploiter | `sniper` | `exploit` | `exploit` | `python3` | Validate critical CVEs by automatic exploitation. | | Spider | `spider` | `robots` | `intrusive` | `katana` | Advanced web spider with JS execution support. | -| SQL Injection Feasibility | `sqli_checker` | `expert` | `intrusive` | `ghauri` | SQL injection feasibility scanner powered by Ghauri. | -| SQLi Exploiter | `sqli_exploiter` | `exploit` | `exploit` | `sqlmap` | Exploit SQL injection in web apps to extract data. | -| SQL Injection Testing | `sqlmap` | `web` | `exploit` | `sqlmap` | Automatic SQL injection and database takeover tool. | +| SQL Injection Feasibility | `sqli_checker` | `expert` | `intrusive` | `ghauri` | Validates potential SQL injection vulnerabilities without exploitation. | +| SQLi Exploiter | `sqli_exploiter` | `exploit` | `exploit` | `sqlmap` | Exploitation-focused workflow for data extraction from confirmed SQL injection findings. | +| SQL Injection Testing | `sqlmap` | `web` | `exploit` | `sqlmap` | Detects SQL injection vulnerabilities and supports controlled database enumeration. | | SSH Runner | `ssh_runner` | `execution` | `intrusive` | `ssh` | Remote command execution via SSH. | | Subdomain Finder | `subdomain-finder` | `recon` | `safe` | `subfinder` | Discover subdomains of a domain. | | Subdomain Scanner | `subdomain_discovery` | `recon` | `safe` | `subfinder` | Enumerate subdomains using passive sources. | @@ -104,6 +104,12 @@ Only run scans against systems you own or are explicitly authorized to assess. | Binary Signature Scan | `yara_scan` | `forensics` | `intrusive` | `yara` | Binary and file-system signature matching with YARA rules. | | DAST Web Proxy (ZAP) | `zap_scanner` | `vulnerability` | `exploit` | `python3` | Dynamic proxy spidering and payload injection. | +### SQL Injection Plugin Guidance + +- `sqli_checker` should be used to validate whether a target appears vulnerable to SQL injection and to assess feasibility before exploitation. +- `sqlmap` should be used for SQL injection testing and controlled database enumeration during assessment workflows. +- `sqli_exploiter` should be used only after a vulnerability has been confirmed and exploitation or data extraction is required. + ## Plugin Input Schema with Examples Plugins can tell us about configurable user inputs through schema fields in their diff --git a/frontend/src/data/scanTools.ts b/frontend/src/data/scanTools.ts index f650c5ef7..673c8a66c 100644 --- a/frontend/src/data/scanTools.ts +++ b/frontend/src/data/scanTools.ts @@ -31,8 +31,8 @@ export const scanTools: ScanTool[] = [ { id: 'wpscan', name: 'WPScan', purpose: 'Specialized WordPress vulnerability auditor', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', isQuickStart: true }, { id: 'nuclei', name: 'Nuclei', purpose: 'Template-based vulnerability detection at scale', riskLevel: 'active', presetCompatibility: 'both', requiresConsent: true, category: 'vulnerability', isQuickStart: true }, { id: 'dir_discovery', name: 'Directory Discovery', purpose: 'Fuzzing for hidden files and directories', riskLevel: 'active', presetCompatibility: 'deep-scan', requiresConsent: true, category: 'vulnerability' }, - { id: 'sqli_checker', name: 'SQLi Checker', purpose: 'Lightweight SQL injection feasibility testing', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' }, - { id: 'sqlmap', name: 'SQLMap', purpose: 'Automated SQL injection and database takeover', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', isQuickStart: true }, + { id: 'sqli_checker', name: 'SQLi Checker', purpose: 'Validate potential SQL injection vulnerabilities without exploitation', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' }, + { id: 'sqlmap', name: 'SQLMap', purpose: 'Detect SQL injection issues and perform controlled database enumeration', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', isQuickStart: true }, { id: 'tls_inspector', name: 'TLS Inspector', purpose: 'SSL/TLS certificate and cipher strength audit', riskLevel: 'passive', presetCompatibility: 'quick-recon', requiresConsent: false, category: 'vulnerability', subcategory: 'network' }, { id: 'joomscan', name: 'JoomScan', purpose: 'Joomla CMS vulnerability and config auditor', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' }, { id: 'droopescan', name: 'DroopeScan', purpose: 'Drupal/Silverstripe plugin and theme auditor', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' }, @@ -47,7 +47,7 @@ export const scanTools: ScanTool[] = [ { id: 'volatility', name: 'Volatility3', purpose: 'Advanced memory forensics and artifact extraction', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' }, // --- PENDING EXPLOIT MODULES (From Reference) --- { id: 'sniper', name: 'Sniper: Auto-Exploiter', purpose: 'Validate critical CVEs by automatic exploitation.', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' }, - { id: 'sqli_exploiter', name: 'SQLi Exploiter', purpose: 'Exploit SQL injection in web apps to extract data.', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' }, + { id: 'sqli_exploiter', name: 'SQLi Exploiter', purpose: 'Exploitation-focused SQL injection workflow for data extraction', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' }, { id: 'xss_exploiter', name: 'XSS Exploiter', purpose: 'Exploit XSS in real life-attacks, extract cookies and data.', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' }, { id: 'http_request_logger', name: 'HTTP Request Logger', purpose: 'Handle incoming HTTP requests and record data.', riskLevel: 'passive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' }, { id: 'subdomain_takeover', name: 'Subdomain Takeover', purpose: 'Discover dangling DNS entries pointing to external services.', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: false, category: 'exploit' }, diff --git a/plugins/sqli_checker/metadata.json b/plugins/sqli_checker/metadata.json index c9c8f4f40..194445018 100644 --- a/plugins/sqli_checker/metadata.json +++ b/plugins/sqli_checker/metadata.json @@ -2,8 +2,8 @@ "id": "sqli_checker", "name": "SQL Injection Feasibility", "version": "1.0.0", - "description": "SQL injection feasibility scanner powered by Ghauri.", - "long_description": "Runs a controlled SQLi feasibility check against a URL parameter and reports injectable indicators.", + "description": "Validates potential SQL injection vulnerabilities using Ghauri.", + "long_description": "Performs controlled feasibility checks to identify potential SQL injection indicators without focusing on exploitation or data extraction.", "category": "expert", "author": { "name": "SecuScan Contributors", @@ -124,5 +124,5 @@ "python_packages": [], "system_packages": [] }, - "checksum": "c6fd02c9a458bf582009d1b4838384afb07a64b1a3837fb8d93f6cc3d8dd4dfa" + "checksum": "62ed5d57c77eaff266ec03e8aa81f2325d2e24d6e71dc2f657072b0df5c64354" } diff --git a/plugins/sqli_exploiter/metadata.json b/plugins/sqli_exploiter/metadata.json index 5d380e0b9..37dfc95fa 100644 --- a/plugins/sqli_exploiter/metadata.json +++ b/plugins/sqli_exploiter/metadata.json @@ -2,8 +2,8 @@ "id": "sqli_exploiter", "name": "SQLi Exploiter", "version": "1.0.0", - "description": "Exploit SQL injection in web apps to extract data.", - "long_description": "Exploit SQL injection in web apps to extract data.", + "description": "SQL injection exploitation and data extraction workflow powered by sqlmap.", + "long_description": "Performs exploitation-focused SQL injection workflows, including database enumeration and data extraction from confirmed SQL injection findings.", "category": "exploit", "author": { "name": "SecuScan Contributors", @@ -83,5 +83,5 @@ "python_packages": [], "system_packages": [] }, - "checksum": "afc0b21532397682b6d160ebeac0f8d4830f0f95cdde362b2b384a12a38de596" + "checksum": "027f567c5a99112334dce179a67b53d406e5e16eb1b08fee901c98f2683dea4f" } diff --git a/plugins/sqlmap/metadata.json b/plugins/sqlmap/metadata.json index da34cd38a..39eb31e18 100644 --- a/plugins/sqlmap/metadata.json +++ b/plugins/sqlmap/metadata.json @@ -2,8 +2,8 @@ "id": "sqlmap", "name": "SQL Injection Testing", "version": "1.0.0", - "description": "Automatic SQL injection and database takeover tool", - "long_description": "SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.", + "description": "SQL injection detection and database enumeration tool.", + "long_description": "Uses sqlmap to detect SQL injection vulnerabilities and perform controlled database enumeration during assessment workflows.", "category": "web", "author": { "name": "SecuScan Contributors", @@ -126,5 +126,5 @@ "python_packages": [], "system_packages": [] }, - "checksum": "109abd6dbca360a17bb9afbcbc5fb8d2493e76749f7e8d16d704fcb490b925c7" + "checksum": "efe8eef95714a4363b68618c000bcec5d5e93b98c7b1168775ffaa98fc66eb8a" }