docs: clarify SQL injection plugin responsibilities

PLUGINS.md

@@ -80,9 +80,9 @@ Only run scans against systems you own or are explicitly authorized to assess.
 | Sitemap Generator | `sitemap_gen` | `robots` | `intrusive` | `katana` | Build complete XML sitemaps by autonomously parsing targets. |
 | Sniper: Auto-Exploiter | `sniper` | `exploit` | `exploit` | `python3` | Validate critical CVEs by automatic exploitation. |
 | Spider | `spider` | `robots` | `intrusive` | `katana` | Advanced web spider with JS execution support. |
-| SQL Injection Feasibility | `sqli_checker` | `expert` | `intrusive` | `ghauri` | SQL injection feasibility scanner powered by Ghauri. |
-| SQLi Exploiter | `sqli_exploiter` | `exploit` | `exploit` | `sqlmap` | Exploit SQL injection in web apps to extract data. |
-| SQL Injection Testing | `sqlmap` | `web` | `exploit` | `sqlmap` | Automatic SQL injection and database takeover tool. |
+| SQL Injection Feasibility | `sqli_checker` | `expert` | `intrusive` | `ghauri` | Validates potential SQL injection vulnerabilities without exploitation. |
+| SQLi Exploiter | `sqli_exploiter` | `exploit` | `exploit` | `sqlmap` | Exploitation-focused workflow for data extraction from confirmed SQL injection findings. |
+| SQL Injection Testing | `sqlmap` | `web` | `exploit` | `sqlmap` | Detects SQL injection vulnerabilities and supports controlled database enumeration. |
 | SSH Runner | `ssh_runner` | `execution` | `intrusive` | `ssh` | Remote command execution via SSH. |
 | Subdomain Finder | `subdomain-finder` | `recon` | `safe` | `subfinder` | Discover subdomains of a domain. |
 | Subdomain Scanner | `subdomain_discovery` | `recon` | `safe` | `subfinder` | Enumerate subdomains using passive sources. |
@@ -104,6 +104,12 @@ Only run scans against systems you own or are explicitly authorized to assess.
 | Binary Signature Scan | `yara_scan` | `forensics` | `intrusive` | `yara` | Binary and file-system signature matching with YARA rules. |
 | DAST Web Proxy (ZAP) | `zap_scanner` | `vulnerability` | `exploit` | `python3` | Dynamic proxy spidering and payload injection. |
 
+### SQL Injection Plugin Guidance
+
+- `sqli_checker` should be used to validate whether a target appears vulnerable to SQL injection and to assess feasibility before exploitation.
+- `sqlmap` should be used for SQL injection testing and controlled database enumeration during assessment workflows.
+- `sqli_exploiter` should be used only after a vulnerability has been confirmed and exploitation or data extraction is required.
+
 ## Plugin Input Schema with Examples
 
 Plugins can tell us about configurable user inputs through schema fields in their

frontend/src/data/scanTools.ts

@@ -31,8 +31,8 @@ export const scanTools: ScanTool[] = [
     { id: 'wpscan', name: 'WPScan', purpose: 'Specialized WordPress vulnerability auditor', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', isQuickStart: true },
     { id: 'nuclei', name: 'Nuclei', purpose: 'Template-based vulnerability detection at scale', riskLevel: 'active', presetCompatibility: 'both', requiresConsent: true, category: 'vulnerability', isQuickStart: true },
     { id: 'dir_discovery', name: 'Directory Discovery', purpose: 'Fuzzing for hidden files and directories', riskLevel: 'active', presetCompatibility: 'deep-scan', requiresConsent: true, category: 'vulnerability' },
-    { id: 'sqli_checker', name: 'SQLi Checker', purpose: 'Lightweight SQL injection feasibility testing', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' },
-    { id: 'sqlmap', name: 'SQLMap', purpose: 'Automated SQL injection and database takeover', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', isQuickStart: true },
+    { id: 'sqli_checker', name: 'SQLi Checker', purpose: 'Validate potential SQL injection vulnerabilities without exploitation', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' },
+    { id: 'sqlmap', name: 'SQLMap', purpose: 'Detect SQL injection issues and perform controlled database enumeration', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', isQuickStart: true },
     { id: 'tls_inspector', name: 'TLS Inspector', purpose: 'SSL/TLS certificate and cipher strength audit', riskLevel: 'passive', presetCompatibility: 'quick-recon', requiresConsent: false, category: 'vulnerability', subcategory: 'network' },
     { id: 'joomscan', name: 'JoomScan', purpose: 'Joomla CMS vulnerability and config auditor', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' },
     { id: 'droopescan', name: 'DroopeScan', purpose: 'Drupal/Silverstripe plugin and theme auditor', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'vulnerability', subcategory: 'web' },
@@ -47,7 +47,7 @@ export const scanTools: ScanTool[] = [
     { id: 'volatility', name: 'Volatility3', purpose: 'Advanced memory forensics and artifact extraction', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' },
     // --- PENDING EXPLOIT MODULES (From Reference) ---
     { id: 'sniper', name: 'Sniper: Auto-Exploiter', purpose: 'Validate critical CVEs by automatic exploitation.', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' },
-    { id: 'sqli_exploiter', name: 'SQLi Exploiter', purpose: 'Exploit SQL injection in web apps to extract data.', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' },
+    { id: 'sqli_exploiter', name: 'SQLi Exploiter', purpose: 'Exploitation-focused SQL injection workflow for data extraction', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' },
     { id: 'xss_exploiter', name: 'XSS Exploiter', purpose: 'Exploit XSS in real life-attacks, extract cookies and data.', riskLevel: 'aggressive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' },
     { id: 'http_request_logger', name: 'HTTP Request Logger', purpose: 'Handle incoming HTTP requests and record data.', riskLevel: 'passive', presetCompatibility: 'none', requiresConsent: true, category: 'exploit' },
     { id: 'subdomain_takeover', name: 'Subdomain Takeover', purpose: 'Discover dangling DNS entries pointing to external services.', riskLevel: 'active', presetCompatibility: 'none', requiresConsent: false, category: 'exploit' },

plugins/sqli_checker/metadata.json

@@ -2,8 +2,8 @@
   "id": "sqli_checker",
   "name": "SQL Injection Feasibility",
   "version": "1.0.0",
-  "description": "SQL injection feasibility scanner powered by Ghauri.",
-  "long_description": "Runs a controlled SQLi feasibility check against a URL parameter and reports injectable indicators.",
+  "description": "Validates potential SQL injection vulnerabilities using Ghauri.",
+  "long_description": "Performs controlled feasibility checks to identify potential SQL injection indicators without focusing on exploitation or data extraction.",
   "category": "expert",
   "author": {
     "name": "SecuScan Contributors",
@@ -124,5 +124,5 @@
     "python_packages": [],
     "system_packages": []
   },
-  "checksum": "c6fd02c9a458bf582009d1b4838384afb07a64b1a3837fb8d93f6cc3d8dd4dfa"
+  "checksum": "62ed5d57c77eaff266ec03e8aa81f2325d2e24d6e71dc2f657072b0df5c64354"
 }

plugins/sqli_exploiter/metadata.json

@@ -2,8 +2,8 @@
   "id": "sqli_exploiter",
   "name": "SQLi Exploiter",
   "version": "1.0.0",
-  "description": "Exploit SQL injection in web apps to extract data.",
-  "long_description": "Exploit SQL injection in web apps to extract data.",
+  "description": "SQL injection exploitation and data extraction workflow powered by sqlmap.",
+  "long_description": "Performs exploitation-focused SQL injection workflows, including database enumeration and data extraction from confirmed SQL injection findings.",
   "category": "exploit",
   "author": {
     "name": "SecuScan Contributors",
@@ -83,5 +83,5 @@
     "python_packages": [],
     "system_packages": []
   },
-  "checksum": "afc0b21532397682b6d160ebeac0f8d4830f0f95cdde362b2b384a12a38de596"
+  "checksum": "027f567c5a99112334dce179a67b53d406e5e16eb1b08fee901c98f2683dea4f"
 }

plugins/sqlmap/metadata.json

@@ -2,8 +2,8 @@
   "id": "sqlmap",
   "name": "SQL Injection Testing",
   "version": "1.0.0",
-  "description": "Automatic SQL injection and database takeover tool",
-  "long_description": "SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.",
+  "description": "SQL injection detection and database enumeration tool.",
+  "long_description": "Uses sqlmap to detect SQL injection vulnerabilities and perform controlled database enumeration during assessment workflows.",
   "category": "web",
   "author": {
     "name": "SecuScan Contributors",
@@ -126,5 +126,5 @@
     "python_packages": [],
     "system_packages": []
   },
-  "checksum": "109abd6dbca360a17bb9afbcbc5fb8d2493e76749f7e8d16d704fcb490b925c7"
+  "checksum": "efe8eef95714a4363b68618c000bcec5d5e93b98c7b1168775ffaa98fc66eb8a"
 }