Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Vulnerabilities

Confirm SQL injection on a parameterized URL

Tiny SQLi check for GET and POST parameters on one URL.

Agent
Confirm a SQL injection point fastTest authenticated endpointsRoute requests through a proxy

overview

What dsss does

Run dsss as a confirmation step after URL discovery: feed one parameterized URL and read FOLDER and FILE findings before opening sqlmap.

Reach for it when you already suspect a parameter and want a small error-based or blind SQLi check before opening sqlmap.

Wire -u for the target, --data for POST bodies, plus --cookie, --referer, --user-agent, and --proxy. Use sibling dsxs for XSS on the same URL shape.

source github.com/stamparm/dsss

use cases

Where dsss fits

Confirm a SQL injection point fast

Point dsss at a single parameterized URL to verify whether a GET or POST parameter is injectable, without spinning up a heavy scanner.

Test authenticated endpoints

Set the Cookie, Referer, and User-Agent headers so dsss reaches pages behind a session or a basic filter and tests the parameters there.

Route requests through a proxy

Send traffic through an HTTP proxy with --proxy to log every request for review or to chain dsss behind a tool that rewrites traffic.

Triage a list of parameterized URLs

Fan dsss across URLs collected by an earlier crawling or discovery stage to flag which endpoints deserve a deeper look with sqlmap.

reference

dsss inputs and flags

6 inputs
NameTypeFlagDescription
urlSTRING-uTarget URL, e.g. http://www.target.com/page.php?id=1.
post-dataSTRING--dataPOST data to test, e.g. query=test.
cookieSTRING--cookieHTTP Cookie header value.
user-agentSTRING--user-agentHTTP User-Agent header value.
refererSTRING--refererHTTP Referer header value.
proxySTRING--proxyHTTP proxy address, e.g. http://127.0.0.1:8080.

Showing key inputs. dsss exposes 6 inputs in total.

example

Run dsss

dsss · command
# confirm a GET parameter is injectable, routed through a local proxypython dsss.py -u "http://example.com/item.php?id=42" --cookie "PHPSESSID=8f2b1c" --proxy "http://127.0.0.1:8080"
sample output
Damn Small SQLi Scanner (DSSS) < 100 LOC (Lines of Code) #v0.4c by Miroslav Stampar (@stamparm) * scanning GET parameter 'id'(i) GET parameter 'id' could be error SQLi injectable (possible DBMS: 'MySQL')* scanning GET parameter 'ref'* scanning POST parameter 'query'(i) POST parameter 'query' could be blind SQLi injectable

guidance

Choosing dsss

Use dsss for a lightweight SQLi confirmation on one parameterized URL. Sibling dsxs covers XSS the same way. For exploitation or data extraction, move to sqlmap.

dsxs

Sibling damn-small scanner for reflected XSS. Same minimal request shape, different vulnerability class.

sqlmap

Full SQLi tool with exploitation and database takeover. dsss stays a tiny confirmation check.

faq

dsss questions

GET parameters in the URL passed with -u, and POST parameters supplied with --data. Both are checked for SQL injection.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run dsss yourself

A target URL feeds dsss, which tests its GET and POST parameters for SQL injection and writes the findings as a queryable output.

Open dsss in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.