💉Tool to enable blind sql injection attacks against websockets using sqlmap
Heavily based on an excellent writeup from Rayhan Ahmed: Automating Blind SQL injection over WebSocket
sqlmap-websocket-proxy -u soc-player.soccer.htb:9091 -p '{"id": "%param%"}' --json usage: sqlmap-websocket-proxy [-h] -u URL -p PAYLOAD [-o PORT] [--json] options: -h, --help show this help message and exit -u URL, --url URL URL to the websocket (example: soc-player.soccer.htb:9091) -p PAYLOAD, --payload PAYLOAD String with params for the playload encoded as %param% (example: {"id": "%param%"}) -o PORT, --port PORT Proxy Port (default: 8080) --json Escape text for JSON payloadspython3 -m pip install sqlmap-websocket-proxypython3 -m pip install sqlmap_websocket_proxy-1.0.0-py3-none-any.whl