Web Application Analysissqlisql-injectionscannercrawlervulnerability

SQLMC

SQLMC is a tool designed to scan a domain for SQL injection vulnerabilities by crawling the given URL up to a specified depth and checking each link.

Description

SQLMC (SQL Injection Massive Checker) is a massive scanner that checks all URLs of a domain for SQL injection vulnerabilities. It crawls the provided URL to a specified depth, tests each discovered link for SQLi issues, and reports the findings. This tool is particularly useful for penetration testers and security researchers performing web application security assessments.

The tool automates the process of identifying potential SQL injection points across an entire domain, saving time compared to manual testing. It supports output to a file for further analysis or reporting. SQLMC is lightweight, with an installed size of 65 KB, and integrates well into Kali Linux workflows.

Use cases include reconnaissance during vulnerability assessments, verifying SQLi protections on web applications, and batch scanning multiple endpoints for common injection flaws.

How It Works

SQLMC crawls the specified URL up to the defined depth, extracting and following links within the domain. For each discovered URL, it performs SQL injection vulnerability checks using predefined payloads or techniques. Results are compiled and can be saved to an output file for review.

Installation

bash
sudo apt install sqlmc

Flags

-h, --helpshow this help message and exit
-u, --url URLThe URL to scan
-d, --depth DEPTHThe depth to scan
-o, --output OUTPUTThe output file

Examples

Display the help message and usage information
sqlmc -h
Scan the URL https://example.com to a depth of 2 levels for SQL injection vulnerabilities
sqlmc -u https://example.com -d 2
Scan https://target.com to depth 3 and save output to results.txt
sqlmc -u https://target.com -d 3 -o results.txt
Scan a local test site to depth 1 using long flag format
sqlmc --url http://testsite.local -d 1
Perform deep scan to depth 4 and output results to a file
sqlmc -u https://vulnerable.app --depth 4 --output sqli_report.txt
Show detailed help using long flag
sqlmc --help
Scan only the root URL without crawling deeper
sqlmc -u https://example.com -d 0
Updated 2026-04-16kali.org ↗