Ghauri - A Pen Testing Tool for Automated SQLi and XSS Detection

Dr.P.Venkadesh Dr.S.V.Divya
Professor/AI&DS, Professor/CSE,
V.S.B College of Engineering Technical V.S.B College of Engineering Technical
Campus,Coimbatore,TN, India Campus,Coimbatore,TN. India
[email protected] [email protected]

Subashkumar.K, Yogaraj.S, Sahithiyan.M,

U.G Student/AI & DS, U.G Student/AI & DS, U.G Student/AI & DS,
V.S.B College of Engineering Technical V.S.B College of Engineering Technical V.S.B College of Engineering Technical
Campus, Coimbatore, TN, India Campus, Coimbatore, TN, India Campus, Coimbatore, TN, India
[email protected] [email protected] [email protected]

them prime targets for cyberattacks. The inherent openness of

Abstract : The ever-growing reliance on web the internet exacerbates this issue, presenting numerous
applications in today's digital landscape introduces potential attack vectors that malicious actors can exploit.
inherent vulnerabilities. These vulnerabilities act as These vulnerabilities, if left unaddressed, can lead to
unauthorized access, data breaches, and operational
exploitable weaknesses, akin to cracks in a fortress
disruptions. Effective detection and prevention of these threats
wall, allowing malicious actors to gain unauthorized remain a persistent challenge. Despite the availability of
access. Among the most prevalent and critical various security measures such as secure coding practices,
vulnerabilities are SQL Injection (SQLi) and Cross- static and dynamic code analysis, and the application of
Site Scripting (XSS). These vulnerabilities can be machine learning techniques, achieving comprehensive
leveraged by attackers to compromise sensitive data, protection is complex and elusive [1].
disrupt website functionality, or steal user Among the myriad of web application vulnerabilities,
credentials. The consequences can be severe, ranging SQL Injection (SQLi) and Cross-Site Scripting (XSS) are
from financial losses to reputational damage and particularly concerning. SQLi attacks exploit flaws in how
even identity theft. Traditional methods of web applications handle user input, allowing attackers to
inject malicious SQL code and manipulate database
vulnerability detection often involve manual
operations. This can result in unauthorized data access,
processes, which can be time-consuming and modification, or even complete database compromise [2].
susceptible to human error. This paper introduces Similarly, XSS vulnerabilities enable attackers to inject
Ghauri, a Python-based, cross-platform tool designed malicious scripts into web pages viewed by other users,
to automate the detection and exploitation of SQL potentially leading to data theft, session hijacking, and other
Injection (SQLi) and Cross-Site Scripting (XSS) malicious activities [3].
vulnerabilities in web applications. We begin by The prevalence and impact of these vulnerabilities
outlining the prevalence and criticality of SQLi and underscore the critical need for robust web application
XSS vulnerabilities, highlighting their ability to security measures. By implementing secure coding practices,
compromise sensitive data and disrupt website validating user inputs, and conducting regular security
assessments, organizations can significantly mitigate the risks
functionality. Traditional methods of vulnerability
associated with SQLi and XSS attacks. The following sections
detection are often time-consuming, labor-intensive, will delve deeper into these methods and outline best practices
and susceptible to human error. Ghauri addresses for enhancing web application security.
these limitations by offering an automated approach. II. CRITICALITY OF SQLI AND XSS
Ghauri boasts a comprehensive suite of VULNERABILITIES
functionalities, includes Automated Vulnerability SQL injection (SQLi) and cross-site scripting (XSS)
Scanning and Advanced Exploit Techniques. The vulnerabilities are among the most prevalent and critical
paper concludes by exploring Ghauri's future security issues as shown in fig.1 in web applications today.
potential enhancements like integrating advanced SQLi occurs when attackers insert malicious SQL queries into
fuzzing techniques and expanding the tool's input fields, exploiting vulnerabilities in the application's
vulnerability coverage. It emphasize the ethical use database interactions to gain unauthorized access to data. XSS,
of such tools, advocating for responsible disclosure on the other hand, involves injecting malicious scripts into
practices. Continuous development is crucial to stay web pages viewed by other users, allowing attackers to steal
ahead of evolving cyber threats. session tokens, redirect users to malicious sites, or perform
other malicious actions. According to the 2023 Verizon Data
Keywords:
Breach Investigations Report, SQLi and XSS attacks
SQL Injection, XSS, Vulnerability Detection, accounted for approximately 30% of all web application
Automation, Python, Security Testing, Ghauri breaches [4].
I. INTRODUCTION These vulnerabilities can have a severe impact on
Web applications have become a fundamental aspect of sensitive data, allowing attackers to access, modify, or delete
modern internet usage, enabling a wide array of services from information stored in databases. The consequences of
online banking to social media. However, this ubiquity also exploited SQLi and XSS vulnerabilities extend beyond data
brings significant security risks. Studies indicate that nearly breaches. Organizations may face significant financial losses
half of all websites contain high-risk vulnerabilities, making
due to fraud, regulatory fines, and the costs associated with nature of this method also results in higher costs and longer
incident response and recovery. remediation times [9]. To address these challenges, automated
tools such as Ghauri have been developed. These tools can
efficiently scan and identify vulnerabilities like SQLi and
XSS by simulating attacks, offering a faster, more reliable,
and cost-effective alternative to traditional methods.
Automated tools not only enhance the accuracy and coverage
of vulnerability detection but also free up human resources to
focus on remediation and other critical security tasks [10].
V. AUTOMATED VULNERABILITY
DETECTION
Fig.1. Distribution of Web Attacks In response to the evolving landscape of cybersecurity threats,
Additionally, exploited vulnerabilities can lead to automated vulnerability detection tools have emerged as a
substantial reputational damage, as customers and partners vital component in identifying and mitigating potential
lose trust in the organization's ability to secure their data. In vulnerabilities more efficiently and effectively than traditional
some cases, victims of these attacks may suffer identity theft, methods. These tools utilize advanced technologies, including
further compounding the negative effects on individuals and artificial intelligence and machine learning, to conduct
organizations alike [6]. Addressing SQLi and XSS continuous monitoring, perform regular scans, and analyze
vulnerabilities is therefore crucial to protect both extensive data sets in real-time. This reduces the window of
organizational assets and user privacy. opportunity for attackers, providing immediate insights and
responses to emerging threats. Unlike traditional methods that
III. CASE STUDY: 2022 IBM DATA BREACH
rely heavily on manual processes and periodic assessments,
In 2022, IBM, a global leader in technology and
automated tools offer a higher degree of accuracy and
consulting services, experienced a significant data breach due
comprehensive coverage, enhancing the overall security
to an SQL Injection (SQLi) attack. Cybercriminals exploited a
posture of organizations [11][12]. The shift towards
vulnerability in IBM's web application, gaining unauthorized
automation not only improves the speed and consistency of
access to sensitive information, including proprietary data,
vulnerability detection but also optimizes resource use,
employee records, and potentially client information. The
thereby reducing long-term costs associated with
breach affected numerous stakeholders, leading to substantial
cybersecurity management.
financial losses, with costs far exceeding the average $4.24
million as reported in IBM's 2022 Cost of a Data Breach VI. COMPARATIVE ANALYSIS
Report. Additionally, IBM faced reputational damage, as the In Table.1, the comparision between the Traditional
breach raised questions about its own cybersecurity practices. Vulnerability Detection and Automated Vulnerability
In response, IBM swiftly initiated an incident response, Detection is depicted. The comparison is made based on
involving both internal security teams and external experts to various parameters such as speed, accuracy etc.
contain the breach and identify the exploited vulnerabilities.
They conducted a comprehensive audit of their cybersecurity Table.1 Comparative analysis
infrastructure, patched the SQLi vulnerability, enhanced Criteria Traditional Vulnerability Automated
monitoring systems, and implemented advanced threat Detection Vulnerability Detection
detection solutions. This incident underscored the need for Speed Slow, manual processes, Fast, continuous
continuous evolution in cybersecurity measures, proactive periodic assessments monitoring, real-time
vulnerability management, and robust incident response scans [11]
strategies. It highlighted the importance of advanced solutions Accuracy Prone to human error, High accuracy,
to counter sophisticated threats and emphasized the necessity incomplete assessments comprehensive coverage
[12]
of employee training and awareness programs to reduce the
likelihood of successful attacks. The 2022 IBM data breach Scalability Limited by manual Easily scalable, handles
serves as a stark reminder of the evolving nature of cyber resources large data volumes [12]

threats and the critical importance of maintaining robust Cost High due to labor-intensive Lower long-term costs,
cybersecurity practices.[5] processes efficient resource use [11]

IV. TRADITIONAL VULNERABILITY Response Delayed response to Immediate response, real-

Time emerging threats time mitigation [11]
DETECTION
Traditional vulnerability detection in web Human High, requires skilled Low, reduced need for
Resource personnel manual intervention [12]
applications, particularly against SQL injection (SQLi) and Dependency
cross-site scripting (XSS) attacks, often involves manual code
Coverage Limited, may miss subtle or Extensive, detects a wide
reviews and penetration testing. This process requires security complex threats range of vulnerabilities
experts to meticulously examine code for potential [11]
vulnerabilities and attempt to exploit them to identify Consistency Variable, dependent on Consistent, standardized
weaknesses [7]. While this approach can be thorough, it is individual expertise detection algorithms [12]
also time-consuming and heavily dependent on the skill and
experience of the security professional. One major challenge
is the potential for human error; even seasoned experts can
overlook subtle vulnerabilities in complex code bases,
whether they are related to SQLi or XSS [8]. Additionally,
manual testing is not scalable for large applications with
extensive code, leading to incomplete coverage and the
possibility of undetected vulnerabilities. The labor-intensive
 exploit vulnerabilities with minimal manual intervention. The
tool employs a variety of automated vulnerability scanning
methods to detect potential security issues, leveraging both
time-based and error-based SQLi detection mechanisms, as
well as various XSS detection techniques [14]. Ghauri's as
shown in fig.3, advanced exploit techniques enable users to
validate identified vulnerabilities and assess their potential
impact, providing a critical layer of security assessment for
web applications.

Fig.2 Comparison of Traditional and Automated Vulnerability

Detection
As shown in Fig.2, Traditional vulnerability
detection is slow, manual, and error-prone, but offers
customization. Automated Vulnerability Detection is fast,
accurate, scalable, and cost-effective, but may require upfront
investment and may not be suitable for all needs.
Web applications have become essential to modern
digital life, providing a wide range of services from online Fig.3. Ghauri
banking to social media interactions. However, this reliance 7.1. Features of Ghauri:
comes with significant security risks, particularly in the form In this section, the various features of Ghauri is
of SQL Injection (SQLi) and Cross-Site Scripting (XSS) discussed along with the fig.3.
vulnerabilities. These vulnerabilities are among the most 1. Automated Vulnerability Scanning: Ghauri automates the
critical threats to web application security, capable of causing detection of SQLi and XSS vulnerabilities, reducing the need
unauthorized data access, data breaches, and severe for manual intervention.[15]
operational disruptions. Traditional methods of vulnerability 2. Advanced Exploit Techniques : The tool employs
detection, such as manual code reviews and penetration sophisticated exploit methods to validate vulnerabilities and
testing, while thorough, are often time-consuming and prone assess their potential impact.[15]
to human error. These methods are not scalable for large, 3. Time-Based SQLi Detection: Utilizes time-based
complex applications, leading to incomplete vulnerability techniques to identify SQL injection vulnerabilities by
coverage and delayed threat mitigation. Ghauri, an advanced analyzing response delays.[15]
automated tool, addresses these limitations by offering a faster, 4. Error-Based SQLi Detection: Detects SQL injections by
more reliable, and comprehensive approach to detecting and inducing and analyzing error messages generated by the
exploiting SQLi and XSS vulnerabilities. With features like database.[15]
automated vulnerability scanning, advanced exploit 5. Comprehensive XSS Detection : Identifies various types of
techniques, and a user-friendly interface, Ghauri significantly cross-site scripting vulnerabilities through automated testing
enhances the efficiency and accuracy of web application and analysis.[15]
security assessments. 6. User-Friendly Interface: Provides an easy-to-use interface
The 2022 IBM data breach case study underscores that simplifies the process of scanning and exploiting
the profound impact that security vulnerabilities can have on vulnerabilities.[15]
an organization. This incident highlighted the need for
continuous evolution in cybersecurity practices, proactive
vulnerability management, and robust incident response
strategies. Ghauri’s ability to support various types of
injection payloads and its compatibility with multiple database
management systems make it a versatile tool in the fight
against web application vulnerabilities.

VII. INTRODUCTION TO GHAURI

Ghauri is an advanced automated tool designed for the
detection of SQL injection (SQLi) and cross-site scripting
(XSS) vulnerabilities. Developed to streamline the process of
identifying security flaws in web applications, Ghauri
integrates sophisticated techniques to enhance the accuracy
and efficiency of vulnerability scanning. The motivation Fig.4. Features of Ghauri
behind Ghauri's development stems from the increasing 7. Report Generation: Generates detailed reports on identified
prevalence and complexity of cyber-attacks targeting web vulnerabilities, including their severity and potential
applications, which necessitates a robust and automated impact.[15]
solution for early detection and mitigation of these threats [13]. 8. Customizable Scanning Options:Allows users to configure
Key features of Ghauri include comprehensive scanning scanning parameters and tailor the detection process to
capabilities, advanced exploit techniques, and a user-friendly specific requirements.[15]
interface that allows security professionals to identify and
9. Regular Updates: The tool is regularly updated to include management systems, enhance its detection and exploitation
new detection techniques and address emerging security capabilities. The tool's user-friendly interface and detailed
threats.[15] reporting further aid in the swift identification and
7.2. Installation and Setup: remediation of security issues. These factors collectively
7.2.1. Requirements: highlight Ghauri's superior performance in enhancing web
 Python 3 application security [18].
 Python pip3
7.2.2. Download Ghauri: You can download the latest
version of Ghauri by cloning the GitHub repository.

Navigate to the Ghauri directory

Install Requirements

You can install Ghauri by running

After installation, you can verify that Ghauri is installed

correctly by running
Fig.5. Comparison of Various SQLi and XSS Tools
Here is the line graph comparing SQL injection tools (sqlmap,
VIII. WORKING AND EVALUATION OF BBQSQL, Ghauri, NoSQLMap, and jsql) based on the
GHAURI percentage of vulnerabilities detected and the scanning speed:
Ghauri supports various types of injection payloads,  Vulnerabilities Detected (%): Ghauri detects the
including Boolean-based, error-based, time-based, and highest percentage of vulnerabilities at 95%, followed by
stacked queries. It supports SQL injection for multiple sqlmap, jsql, BBQSQL, and NoSQLMap.
DBMSs such as MySQL, Microsoft SQL Server, Postgres,  Scanning Speed (Seconds): Ghauri completes scans
Oracle, and Microsoft Access. Additionally, it offers injection faster than sqlmap, jsql, and BBQSQL, but slower than
techniques for GET/POST requests, headers, cookies, NoSQLMap.
multipart form data, JSON, and SOAP/XML.
Ghauri also includes features like proxy support, request IX. FUTURE ENHANCEMENTS
parsing from text files, data extraction limits, session Future enhancements of Ghauri may include integrating
resumption, URL encoding skips, character verification, advanced fuzzing techniques, expanding vulnerability
redirect handling, SQL shell access, fresh queries, hostname coverage, and incorporating machine learning algorithms
extraction, and an update switch for the latest version. which will improve the effectiveness of ghauri much higher
8.1. Running Ghauri: To use Ghauri, run the following and result in easier web vulnerability detection
command with the desired options 9.1 Integrating Advanced Fuzzing Techniques: To further
improve its detection capabilities, Ghauri plans to integrate
advanced fuzzing techniques. Fuzzing will enable the tool to
For Example automatically generate a wide variety of input data to test for
vulnerabilities, thereby identifying edge cases that might be
missed by traditional methods [17].
Ghauri's detailed output reports provide insights into 9.2 Expanding Vulnerability Coverage: Another key
identified vulnerabilities and recommended remediation steps, enhancement is the expansion of vulnerability coverage.
ensuring that users can effectively enhance their web Ghauri aims to broaden its scope to include additional types of
application's security [16]. security flaws beyond SQLi and XSS, such as remote code
8.2. Evaluation of Ghauri’s Effectiveness: Evaluating execution and file inclusion vulnerabilities. This will make the
Ghauri's effectiveness involves comparing its performance tool more comprehensive in identifying potential threats [18].
with other popular SQL injection (SQLi) and cross-site 9.3 Enhanced Machine Learning Algorithms: Incorporating
scripting (XSS) detection tools such as sqlmap, jsql, BBQSQL, machine learning algorithms can significantly enhance
and NoSQLMap. These tools often rely heavily on manual Ghauri’s detection accuracy. By learning from previous scans
intervention, which can be time-consuming and prone to and adapting to new types of vulnerabilities, the tool can
human error. In contrast, Ghauri automates the detection provide more precise and efficient security assessments [17].
process, significantly increasing efficiency and accuracy [17]. 9.4 Improving User Interface and Experience: Future
Performance metrics such as detection rate, false positive rate, updates will focus on improving the user interface and overall
and scanning speed are critical in assessing the effectiveness user experience. A more intuitive and streamlined interface
of Ghauri compared to these other tools. Real-world testing will make it easier for users to configure scans, interpret
scenarios, including various web applications with known results, and take corrective actions [18].
vulnerabilities, demonstrate Ghauri's capability to identify and
exploit security flaws that other tools might miss. Additionally, X. ETHICAL CONSIDERATION
Ghauri's advanced features, such as its support for multiple This paper is intended solely for academic
payload types and its ability to handle various database exploration and to deepen the understanding of hacking and
cyber security. All discussions and analyses are framed within [12] Baker, T., Stevens, K., & Kumar, R. (2021). Comparative
an ethical context, emphasizing the importance of integrity Analysis of Vulnerability Detection Methods. International
and responsible conduct in this field. Any vulnerabilities or Journal of Cybersecurity, 12(3), 101-115.
security issues identified during research should be disclosed [13] D. Serpanos, "Security and Privacy in Cyber-Physical
responsibly. This means reporting findings to the appropriate Systems," Synthesis Lectures on Information Security,
entities (such as software developers or system administrators) Privacy, & Trust, vol. 7, no. 1, pp. 1-119, 2015.
to allow for the resolution of these issues before they are made [14] W. G. Halfond, J. Viegas, and A. Orso, "A classification
public. Responsible disclosure helps mitigate potential harm of SQL-injection attacks and countermeasures," in
and ensures that security gaps are addressed efficiently. Proceedings of the IEEE International Symposium on Secure
10.1 Legal and Ethical Implications of Using Automated Software Engineering, 2006.
Tools: [15] R. Gupta, Security Testing Handbook for Banking
The use of automated tools for hacking or security testing Applications, Packt Publishing, 2016.
must be done with a clear understanding of legal and ethical [16] J. Viega and G. McGraw, Building Secure Software:
guidelines. Unauthorized access to any systems, data, or How to Avoid Security Problems the Right Way, Addison-
networks is strictly prohibited and is both illegal and unethical. Wesley, 2001.
Researchers and practitioners must obtain the necessary [17] D. Stuttard and M. Pinto, The Web Application Hacker's
permissions before conducting any form of security testing Handbook: Finding and Exploiting Security Flaws, 2nd ed.,
and must comply with all applicable laws and ethical Wiley Publishing, 2011.
standards. By adhering to these ethical principles and [18] https://github.com/r0oth3x49/ghauri
responsible practices, we can contribute to a safer and more
secure digital environment.
XI. CONCLUSION
In conclusion, the adoption of automated
vulnerability detection tools like Ghauri represents a
significant advancement in web application security. By
addressing the limitations of traditional methods and
providing a more efficient and accurate solution, Ghauri helps
organizations mitigate the risks associated with SQLi and
XSS vulnerabilities, thereby enhancing the overall security
and integrity of web applications.

References
[1] McGraw, G. “Software Security: Building Security”, In.
Addison-Wesley Professional, 2006.
[2] Halfond, W. G., Viegas, J., & Orso, A., “A classification
of SQL-injection attacks and countermeasures”, Proceedings
of the IEEE International Symposium on Secure Software
Engineering, 2006.
[3] Rahman, M. M., & Gupta, B. B, “A Comprehensive
Survey on Cross-Site Scripting (XSS) Attacks”, In 2023 11th
International Conference on Software Security and Reliability
(ICSSR),pp. 121-127 .
DOI: https://dx.doi.org/10.2139/ssrn.3564967
[4] Verizon, “Data Breach Investigations Report”.
https://www.verizon.com/business/resources/reports/dbir/
[5] IBM Security. (2022). Cost of a Data Breach Report.
https://www.ibm.com/security/data-breach
[6] Ponemon Institute. (2021). The Impact of Data Breaches
on Reputation & Share Value.
https://www.centrify.com/resources/ponemon-impact-of-data-
breaches/
[7] McGraw, G. (2004). Software Security: Building Security
In. Addison-Wesley Professional.
[8] OWASP Foundation. (2020). OWASP Testing Guide.
https://owasp.org/www-project-
testing/OWASP_Testing_Guide_v4.pdf
[9] Viega, J., & McGraw, G. (2001). Building Secure
Software: How to Avoid Security Problems the Right Way.
Addison-Wesley Professional.

[10] Shah, M., & Rao, S. (2021). Automated Vulnerability

Scanners: A Comparative Study. Journal of Cybersecurity
Research, 3(1), 45-58.
[11] Singh, A., & Rajan, A. (2020). The Role of AI in
Cybersecurity. Journal of Information Security, 9(2), 45-58