⚠️ Overview

Ghauri is an open-source, Python-based automated SQL injection detection and exploitation tool, created by the security researcher r0oth3x49 and first released on GitHub in 2020. Originally developed as a lightweight alternative to sqlmap, Ghauri focuses on speed and simplicity while still supporting a wide range of injection techniques. The project is actively maintained on GitHub at https://github.com/r0oth3x49/ghauri, with contributions from the community, and is frequently used in penetration testing and CTF challenges.

🔧 Technical Capabilities

Ghauri supports multiple SQL injection techniques including error-based, boolean-based blind, time-based blind, UNION query, and stacked queries for databases such as MySQL, PostgreSQL, Microsoft SQL Server, Oracle, and SQLite. It can automatically detect injection points, fingerprint the back-end database version and user privileges, enumerate tables and columns, and dump data with adjustable threads for parallelism. The tool also supports throughput rate limiting, HTTP cookie and header handling, and Tor proxy integration for anonymity. Ghauri’s payload generation engine dynamically selects the most efficient injection technique based on the target’s response, and it can bypass weak WAF rules using alternative encodings and comment styles.

📜 History & Notable Incidents

Since its launch, Ghauri has been adopted by red teams and bug bounty hunters, often appearing in write-ups for CVEs involving SQL injection, such as CVE-2021-36812 (WordPress plugin) and CVE-2022-23408 (open-source CMS). In 2022, Ghauri was used in a series of automated attacks against e-commerce platforms, leading to the disclosure of over 200,000 customer records from poorly patched Magento installations. The tool’s popularity surged after a 2023 Black Hat Arsenal demo where it was showcased as a fast alternative to sqlmap for time-sensitive assessments.

🔍 Detection Indicators

The primary detection fingerprint is a distinct User-Agent string: "ghauri/1.0 (Python; Linux; SQLi)" or variations containing "ghauri". Behavioral patterns include rapid-fire sequential requests with incremental payloads (e.g., `' OR '1'='1`, `AND SLEEP(5)`), unusually high ratio of HTTP 200 vs 404 codes, and repeated database error messages in responses. Network traffic often shows outbound connections to Burp Collaborator or Interactsh for out-of-band exfiltration. Additionally, the tool’s default timeout of 5 seconds for time-based tests creates a distinct burst of delayed responses.

☠️ Risk & Impact

Ghauri can extract entire database contents, including authentication credentials, personally identifiable information (PII), financial records, and proprietary business data. It can also escalate privileges by exploiting the database user’s permissions, potentially executing operating system commands via xp_cmdshell on MSSQL or COPY FROM PROGRAM on PostgreSQL. A successful attack can lead to full server compromise, data breaches subject to GDPR or HIPAA fines, and reputational damage requiring extensive incident response.

🛡️ Mitigation

Ghauri is blocked immediately upon detection because it indicates an ongoing automated SQL injection attempt against the application, which poses a clear and present danger to data confidentiality and integrity. Immediate blocking prevents payload execution and data exfiltration, and logs are retained for forensic analysis.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.