Automated SQL Injection Scanner & Data Extractor

sahikosql delivers precision target web crawling, multi-vector SQL injection probing (Union-Based, Error-Based, Boolean-Blind), automated schema discovery, and chunked marker-delimited database extraction in a pitch-black monochrome glassmorphic UI.

Download Release Build (.apk) Test Simulator
API 24+ Android 7 - 14
5 Engines DB Dialects
5.0 MB Package Size
100% Local Processing
CAPABILITIES & ENGINE FEATURES

Designed for Security Auditors & Researchers

Every subsystem in sahikosql is built to automate penetration testing while guaranteeing stability, preventing memory leaks, and managing target request limits.

[WEB_CRAWLER]

Automated Web Crawler

Discovers internal endpoints, query parameters, and form submit fields automatically. Parses anchor tags and extracts parameters for immediate vulnerability probing.

[VULN_ENGINE]

Multi-Vector Probing Engine

Scans target endpoints using Union-Based, Error-Based, and Boolean-Blind SQL injection heuristics. Confirms vulnerability points without corrupting target data.

[FINGERPRINT]

Database Engine Fingerprinting

Identifies target database engine signatures including MySQL, PostgreSQL, SQLite, Microsoft SQL Server, and Oracle DB automatically.

[CHUNKED_STREAM]

Marker-Delimited Extraction

Employs marker delimiters ([SQLI_START] / [SQLI_END]) with GROUP_CONCAT and LIMIT/OFFSET pagination to extract database records safely.

[MATRIX_VIEW]

Full-Screen Matrix Table Viewer

Displays extracted database tables in a full-screen, dual-axis scrollable layout with cell inspection, selectable text, and horizontal scrolling for wide schemas.

[HUD_TERMINAL]

Real-Time Terminal HUD

Displays real-time scan events, raw payload requests, and system diagnostics with live timestamping and instant Show / Hide toggle controls.

INTERACTIVE DEMO

Test the Scanning & Extraction Engine

Experience how sahikosql detects column counts, fingerprints database backends, and extracts marker-delimited records in real time.

sahikosql Terminal HUD & Simulation Workstation STATUS: READY
PRESET TARGET AUDIT SCENARIOS
PHP / MySQL E-Commerce PostgreSQL Financial Portal SQLite Compact App
[13:25:00] [System] sahikosql engine initialized. Ready to accept target URL.
[13:25:01] [System] Enter target URL and click 'START SIMULATED AUDIT' above.
ENGINE ARCHITECTURE

Payload Strategy & Protocol

How sahikosql safely extracts schema information and table rows without breaking web application layouts or overwhelming target servers.

1. Column Count Heuristic Probing

The engine executes a binary search with ' ORDER BY N-- - up to N=15. When an HTTP 500 error or SQL exception occurs, it falls back to binary ' UNION SELECT 1,2,...N-- - validation.

2. Marker-Delimited Payload Wrapping

To isolate database strings from surrounding HTML markup, payloads inject strict boundary markers [SQLI_START] and [SQLI_END] into target columns.

3. Memory-Safe Chunked Pagination

Row dumps are requested in chunks of 50 records (LIMIT 50 OFFSET N) using GROUP_CONCAT / STRING_AGG, capping table loops at 500 rows to ensure zero memory exhaustion.

KOTLIN EXTRACTION ENGINE SAMPLE ResponseAnalyzer.kt 
// Marker-Delimited Union Payload Builder
private fun buildUnionPayload(colCount: Int, targetExpr: String): String {
    val cols = Array(colCount) { i ->
        if (i == 0) targetExpr else "${i + 1}"
    }
    return "' UNION SELECT ${cols.joinToString(",")}-- -"
}

// Database Name Extraction Payload (MySQL)
val expr = "CONCAT('[SQLI_START]', database(), '[SQLI_END]')"

// Schema Discovery Payload
val schemaExpr = "CONCAT('[SQLI_START]', GROUP_CONCAT(CONCAT(table_name,'::',column_name) SEPARATOR '|||'), '[SQLI_END]') FROM information_schema.columns WHERE table_schema=database()"
COMPATIBILITY MATRIX

Supported Database Engines

sahikosql includes tailored payload dialects for all major SQL database management engines.

ENGINE // 01
MySQL / MariaDB
Fully Supported

CONCAT & GROUP_CONCAT SEPARATOR dialect

ENGINE // 02
PostgreSQL
Fully Supported

String concatenation (||) & STRING_AGG dialect

ENGINE // 03
SQLite
Fully Supported

sqlite_master & GROUP_CONCAT dialect

ENGINE // 04
MS SQL Server
Fully Supported

FOR XML PATH & STRING_AGG OFFSET FETCH dialect

ENGINE // 05
Oracle Database
Signature Detection

all_tab_columns & LISTAGG dialect

Download sahikosql v1.0.0

Get the official release build APK package for Android. Fast, standalone build ready for immediate installation.

Package Name com.whitehacklabs.securityscanner
Release Artifact sahikosql-v1.0.0-release.apk
File Size 5.0 MB (5,162,501 bytes)
Target Android SDK API Level 34 (Android 14)
Min Android SDK API Level 24 (Android 7.0+)
SHA-256 Checksum 0fa53f6a5f3c176bb51960cf665397e5dcb000ff16ac6cb4fcd87bee5d7d87f3
DOWNLOAD RELEASE BUILD (.APK)
FREQUENTLY ASKED QUESTIONS

Everything You Need to Know

How do I install the APK on Android? +
Download the sahikosql-v1.0.0-release.apk file to your Android device. Open Settings > Security, enable "Install apps from unknown sources" or grant permission to your file manager, then tap the APK file to install.
Is root access required on the Android device? +
No root access is required. sahikosql runs completely in user space on standard non-rooted Android devices running Android 7.0 (API Level 24) or higher.
Does sahikosql store or transmit my audit logs externally? +
No. All crawling, payload testing, log streaming, and database dump parsing occur strictly locally on your Android device. No scan data or credentials are ever sent to external cloud servers.
What happens if the target database table has hundreds of columns or rows? +
The extraction engine employs safe chunked pagination (LIMIT 50 OFFSET N) and full-screen dual-axis scrollable matrix tables to render large databases smoothly without causing app memory crashes.