Skip to content

Commit 50ac093

Browse files
javierpr0javierpr0
committed
docs: rewrite README with complete feature list and updated architecture
Reflects current state: self-contained sidecar, SQLite persistence, 20+ features, multi-platform CI, keyboard shortcuts reference, and accurate project structure.
1 parent f90471d commit 50ac093

1 file changed

Lines changed: 102 additions & 66 deletions

File tree

‎README.md‎

Lines changed: 102 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,137 @@
11
# SQLMap UI
22

3-
Desktop application built with [Tauri](https://tauri.app/) that provides a graphical interface for [sqlmap](https://sqlmap.org/), the automatic SQL injection and database takeover tool.
3+
A fully self-contained desktop application for [sqlmap](https://sqlmap.org/) — the automatic SQL injection and database takeover tool. Built with [Tauri](https://tauri.app/), React, and Rust.
44

5-
## Screenshots
6-
7-
The app features a dark theme with a configuration panel on the left and a real-time terminal output on the right. Multiple scans can run simultaneously in separate tabs.
5+
**No Python installation required.** The app bundles sqlmap + Python as a standalone sidecar binary via PyInstaller.
86

97
## Features
108

11-
- Full sqlmap configuration through a visual interface (target URL, POST data, cookies, detection level/risk, DBMS selection, techniques, tamper scripts, and more)
12-
- Real-time terminal output with color-coded lines (stdout, stderr, info, errors)
13-
- Multi-tab support: run multiple scans simultaneously, each with independent configuration and output
14-
- Command preview: see the exact sqlmap command before executing
15-
- Start/stop scan controls
16-
- Tab labels auto-update to show the target hostname
17-
- Native macOS application (~10MB)
18-
19-
## Requirements
20-
21-
- **Python 3** (for sqlmap)
22-
- **Rust** (for building the Tauri backend)
23-
- **Node.js** and **pnpm** (for building the frontend)
9+
### Core
10+
- Full sqlmap configuration: URL, method, POST data, cookies, custom headers, level, risk, threads, DBMS, techniques, tamper scripts, extra arguments
11+
- Real-time terminal output with smart syntax coloring (`[CRITICAL]`, `[WARNING]`, `[INFO]`, `injectable`, `Parameter`)
12+
- Multi-tab: run multiple scans simultaneously with independent config and output per tab
13+
- Interactive stdin: respond to sqlmap prompts (Y/n, etc.) directly in the UI
14+
- Command preview tab
15+
16+
### Findings & Reporting
17+
- **Findings panel**: auto-parses vulnerabilities from output — shows parameter, injection type, title, and payload in structured cards
18+
- **Export HTML report**: download a styled report with config and color-coded output
19+
- **Export Burp XML**: export findings as Burp Suite-compatible XML
20+
21+
### Productivity
22+
- **Search** (Cmd+F): filter output lines with live highlighting
23+
- **History**: last 50 scans stored in SQLite, click to re-open in a new tab
24+
- **Profiles**: save, load, and delete named configurations
25+
- **Batch scan**: paste multiple URLs to launch one tab per target
26+
- **Import requests**: paste raw HTTP requests from Burp Suite or DevTools — auto-parses URL, method, headers, cookies, body
27+
- **Burp XML import**: import Burp Suite XML exports directly
28+
- **Drag & drop**: drop `.txt` files to open batch scan, drop `.req`/`.http` files to import requests
29+
30+
### UX
31+
- **Light / Dark theme** with toggle (persisted)
32+
- **Keyboard shortcuts**: Cmd+R (run), Cmd+. (stop), Cmd+T (new tab), Cmd+W (close tab), Cmd+F (search), Escape (close modals)
33+
- **Resizable panels**: drag the border between config and terminal (280px–600px)
34+
- **System notifications**: macOS notification when a scan completes
35+
- **Auto-update**: checks GitHub Releases for new versions on startup
36+
- **Custom icon**: SQL injection-themed app icon
37+
38+
## Requirements (for building)
39+
40+
- **Rust** 1.77+
41+
- **Node.js** 20+ and **pnpm** 10+
42+
- **Python 3** and **PyInstaller** (only for building the sidecar)
43+
44+
> End users don't need any of these — the built `.app` / `.dmg` / `.msi` / `.deb` is fully self-contained.
2445
2546
## Project Structure
2647

2748
```
28-
tests/
29-
├── sqlmap/ # sqlmap (cloned from github)
30-
│ ├── sqlmap.py # Main sqlmap entry point
31-
│ └── run.py # Wrapper that fixes MySQLdb import issues
32-
└── sqlmap-ui/ # Tauri desktop app
33-
├── src/ # React frontend
34-
│ ├── App.tsx # Main component with multi-tab scan UI
35-
│ ├── styles.css # Dark theme styles
36-
│ ├── main.tsx # React entry point
37-
│ └── vite-env.d.ts # Vite type declarations
38-
├── src-tauri/ # Rust backend
39-
│ ├── src/lib.rs # Tauri commands (sqlmap path resolution)
40-
│ ├── src/main.rs # App entry point
41-
│ ├── Cargo.toml # Rust dependencies
42-
│ ├── tauri.conf.json # Tauri configuration
43-
│ └── capabilities/ # Shell permissions for spawning python3
44-
├── index.html # HTML entry point
45-
├── vite.config.ts # Vite configuration
46-
├── tsconfig.json # TypeScript configuration
47-
└── package.json # Node dependencies and scripts
49+
sqlmap-ui/
50+
├── src/ # React frontend
51+
│ ├── App.tsx # Main component (~1100 lines)
52+
│ ├── styles.css # Full dark + light theme
53+
│ ├── main.tsx # React entry point
54+
│ └── vite-env.d.ts
55+
├── src-tauri/ # Rust backend
56+
│ ├── src/lib.rs # Plugin setup, SQLite migrations
57+
│ ├── Cargo.toml # Rust dependencies
58+
│ ├── tauri.conf.json # App config, plugins, sidecar
59+
│ ├── capabilities/ # Shell, notification, SQL, updater permissions
60+
│ ├── binaries/ # sqlmap sidecar (PyInstaller binary)
61+
│ └── icons/ # Custom app icons (all platforms)
62+
├── scripts/
63+
│ └── build-sidecar.sh # Build sidecar for current platform
64+
├── .github/workflows/
65+
│ └── build.yml # CI: multi-platform builds
66+
├── app-icon.png # Source icon (1024x1024)
67+
├── index.html
68+
├── vite.config.ts
69+
├── tsconfig.json
70+
└── package.json
4871
```
4972

50-
## Setup
73+
## Quick Start
5174

5275
```bash
53-
# 1. Clone sqlmap (if not already done)
54-
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap
55-
56-
# 2. Install frontend dependencies
76+
# Clone the repo
77+
git clone <repo-url> sqlmap-ui
5778
cd sqlmap-ui
79+
80+
# Install dependencies
5881
pnpm install
59-
```
6082

61-
## Development
83+
# Build the sidecar (requires Python 3 + PyInstaller + sqlmap cloned nearby)
84+
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git ../sqlmap
85+
pip install pyinstaller
86+
bash scripts/build-sidecar.sh
6287

63-
```bash
64-
cd sqlmap-ui
88+
# Run in development
6589
pnpm tauri dev
66-
```
67-
68-
This starts the Vite dev server on port 1420 with HMR and launches the Tauri window.
69-
70-
## Build
7190

72-
```bash
73-
cd sqlmap-ui
91+
# Build for production
7492
pnpm tauri build
7593
```
7694

77-
Build artifacts:
78-
- **macOS app**: `src-tauri/target/release/bundle/macos/SQLMap UI.app`
79-
- **DMG installer**: `src-tauri/target/release/bundle/dmg/SQLMap UI_0.1.0_aarch64.dmg`
95+
## Build Output
96+
97+
| Platform | Artifact | Size |
98+
|----------|----------|------|
99+
| macOS (arm64) | `SQLMap UI.app` | ~41 MB |
100+
| macOS (arm64) | `SQLMap UI_x.x.x_aarch64.dmg` | ~34 MB |
101+
| Linux | `.deb`, `.AppImage` | ~35 MB |
102+
| Windows | `.msi`, `.exe` | ~35 MB |
80103

81104
## How It Works
82105

83-
1. **Path resolution**: The Rust backend (`lib.rs`) locates `sqlmap/run.py` by searching relative to the executable in multiple candidate paths (dev, release bundle, sibling directory), with a hardcoded fallback.
106+
1. **Sidecar binary**: sqlmap + Python 3.10 are compiled into a single standalone binary (~30 MB) using PyInstaller. Tauri bundles it inside the `.app` as an `externalBin`.
84107

85-
2. **Python wrapper**: `sqlmap/run.py` patches a broken `MySQLdb` import before delegating to the real `sqlmap.py`. This avoids crashes when `mysqlclient` is installed but its native library (`libmysqlclient`) is missing.
108+
2. **Shell execution**: The React frontend uses `Command.sidecar()` from `@tauri-apps/plugin-shell` to spawn the sidecar. stdout/stderr are streamed to the terminal in real time. stdin is writable for interactive prompts.
86109

87-
3. **Shell execution**: The frontend uses Tauri's `@tauri-apps/plugin-shell` to spawn `python3` as a subprocess. stdout/stderr are streamed to the terminal in real time.
110+
3. **Persistence**: Scan history and profiles are stored in a SQLite database (`sqlmap-ui.db`) via `@tauri-apps/plugin-sql` with automatic schema migrations.
88111

89-
4. **Multi-tab**: Each tab maintains its own state (config, output, running status, child process reference). Tabs can be created, switched, and closed independently.
112+
4. **Multi-tab architecture**: Each `ScanTab` holds its own config, output, child process reference, and view mode. Tabs are fully independent — you can run 5 scans against different targets simultaneously.
90113

91114
## Tech Stack
92115

93-
| Layer | Technology |
94-
|----------|-------------------------------------|
95-
| Frontend | React 19, TypeScript 6, Vite 8 |
96-
| Backend | Rust, Tauri 2.10 |
97-
| Tool | sqlmap 1.10.x (Python 3) |
98-
| Package | pnpm 10 |
116+
| Layer | Technology |
117+
|-------------|-----------------------------------------------|
118+
| Frontend | React 19, TypeScript, Vite 8 |
119+
| Backend | Rust, Tauri 2.10 |
120+
| Database | SQLite (via tauri-plugin-sql) |
121+
| Sidecar | sqlmap 1.10 + Python 3.10 (PyInstaller) |
122+
| CI/CD | GitHub Actions (macOS, Linux, Windows) |
123+
| Package | pnpm 10 |
124+
125+
## Keyboard Shortcuts
126+
127+
| Shortcut | Action |
128+
|----------|--------|
129+
| `Cmd+R` | Run scan |
130+
| `Cmd+.` | Stop scan |
131+
| `Cmd+T` | New tab |
132+
| `Cmd+W` | Close tab |
133+
| `Cmd+F` | Search output |
134+
| `Escape` | Close modals / search |
99135

100136
## License
101137

0 commit comments

Comments
 (0)