Ghauri SQL Injection Detection and Testing Tool

Ghauri is an open-source, cross-platform tool that automates the detection and testing of SQL injection vulnerabilities in web applications. Developed by Nasir Khan (r0ot h3x49), it supports multiple injection techniques, database platforms, and HTTP request formats, making it useful for authorized penetration testing and application security assessments.

Security professionals can use Ghauri to investigate potentially vulnerable parameters, analyze application responses, and assess database exposure in controlled environments. Its automation features also help streamline repetitive testing tasks.

Key Features of Ghauri

Ghauri supports several SQL injection techniques, allowing testers to examine how an application processes database queries. Its detection capabilities include:

• Boolean-based blind SQL injection: Identifies vulnerabilities by comparing application responses to true and false conditions.
• Error-based SQL injection: Analyzes database errors that may reveal injection behavior.
• Time-based blind SQL injection: Uses response delays to investigate potential injection points when direct output is unavailable.
• Stacked queries: Tests scenarios in which multiple SQL statements may be processed in a single request, depending on database support.

The tool supports several database management systems, including MySQL, Microsoft SQL Server, PostgreSQL, Oracle, and Microsoft Access. Supported request formats include GET and POST parameters, HTTP headers, cookies, JSON, SOAP/XML payloads, and multipart form data.

Additional Capabilities

• Proxy support: Routes requests through configured proxies for authorized testing and traffic analysis.
• Session management: Helps resume interrupted assessments and avoid repeating completed work.
• Controlled data extraction: Provides options such as --start and --stop to limit extraction ranges where supported.
• Customizable detection: Offers configuration options for adjusting tests and payload behavior.
• Interactive SQL shell: Includes an experimental SQL shell for supported testing scenarios.
• Batch processing: Supports working with multiple targets from a file and handling HTTP redirects.

These capabilities help security researchers investigate different application behaviors. For broader reconnaissance before a web application assessment, see our guide to WhatWeb, a web application fingerprinting tool.

How to Install Ghauri

Ghauri requires Python 3 and pip. On a compatible system with Git installed, clone the official repository and install its dependencies:

git clone https://github.com/r0oth3x49/ghauri.git
cd ghauri
python3 -m pip install --upgrade -r requirements.txt

Follow the project’s current installation instructions if your Python environment requires a virtual environment or additional dependencies. Review the repository before installing software, particularly when working on production or sensitive systems.

Checking Ghauri Options

After installation, display the available command-line options with:

ghauri --help

For a controlled lab or an application you are explicitly authorized to test, specify a test URL containing a parameter:

ghauri -u "http://127.0.0.1/vuln.php?id=1" --dbs

This example illustrates a database enumeration option against a local lab application. The --dbs option requests database enumeration if Ghauri identifies a usable injection point and the target permits the relevant operation. A vulnerable parameter is not guaranteed to be present, and application responses can produce false positives or inconclusive results.

Ghauri for Authorized Security Testing

Ghauri offers an alternative approach to automated SQL injection assessment, with support for multiple database engines and request types. Its creators designed it to address testing scenarios that may be difficult for other tools to handle. However, detection results depend on application behavior, configuration, and the tool version, so findings should be validated carefully.

Use Ghauri only on systems you own or have explicit permission to assess. Database enumeration and extraction can expose sensitive information or disrupt services. For professional assessments, define the testing scope in advance, use non-production environments where possible, and document findings so developers can correct vulnerable queries through parameterized statements and other secure coding practices.

For source code, supported options, and the latest usage guidance, visit the official Ghauri GitHub repository.