live · scanning repos
Scanrepo
github.com
DANGER
malware detected
github.com / sqlmapproject

sqlmapproject/sqlmap

Python·895 files·commit 11afdcb·scanned 5d ago·cached ✓
75/100
DANGEROUS
Sensitive capability combinations reachable from entry points. Do not run without review.

This repository contains patterns associated with malware. Do NOT run this code.

verdict accurate?
38,769 stars
Research / educational context
Partial architecture graph
threat-state: dangerouslive

FINDINGS ░▒▓

warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.lib/controller/controller.py
                                                try:
                                                    process = subprocess.Popen(conf.alert, shell=True)
                                            ...
+4
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.extra/beep/beep.py
def _cygwin_beep(filename):
    os.system("play-sound-file '%s' 2>/dev/null" % filename)

def _mac_wav_play(filename):
+4
warningPython subprocess / os.system usageos.system() or subprocess with shell=True / suspicious commands can execute arbitrary shell commands. Plain pip/package installs are usually benign.lib/core/update.py
        try:
            process = subprocess.Popen("pip install -U sqlmap", shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, cwd=paths.SQLMAP_ROOT_PATH)
            output, _ = process.c...
+4
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.lib/request/connect.py
                try:
                    compile(getBytes(re.sub(r"\s*;\s*", "\n", conf.evalCode)), "", "exec")
                except SyntaxError as ex:
                    if ex.text:
+7
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.lib/request/inject.py
        try:
            candidate = eval(repr(value).replace("\\\\x", "\\x").replace("u'", "'", 1)).decode(conf.encoding or UNICODE_ENCODING)
            if "\\x" not in candidate:
                va...
+8
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.lib/request/inject.py
        try:
            candidate = eval(repr(value).replace("\\\\x", "\\x").replace("u'", "'", 1)).decode(conf.encoding or UNICODE_ENCODING)
            if "\\x" not in candidate:
                va...
+7
criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.lib/techniques/hql/inject.py
    """Existence probe helper: an unmapped entity/attribute makes the ORM query fail
    to compile (error page), which for a yes/no existence question is a definitive
    'no'. Unlike value bisection...
+7
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.tests/test_authrefresh.py
        namespace = {}
        eval(compile(source, path, 'exec'), namespace)
        testCase.assertEqual(namespace['refresh'](), {'Authorization': 'Bearer <fresh token>'})
        testCase.assertNot...
+8
criticalPython remote code executionFetching code from a remote URL and immediately executing it (exec(requests.get(...).text)) is a classic malware dropper pattern.tests/test_authrefresh.py
from thirdparty.six.moves import BaseHTTPServer, socketserver
from thirdparty.six.moves import urllib as _urllib

_GET_PAGE = Connect.__dict__['getPage']
+10
criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.tests/test_keyset_engine.py
    expr = expr.replace("=", "==")
    return bool(eval(expr))
+8
infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2
criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.lib/core/settings.py+5
criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.lib/request/webhooksite.py+5
criticalKnown malicious / C2 domainKnown domains used by Lazarus Group and other malware for hosting payloads or exfiltrating data.lib/techniques/xxe/inject.py+5
warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.lib/core/settings.py+4
warningHigh-entropy string literalsFound 5 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.lib/utils/crawler.py+3
warningHigh-entropy string literalsFound 16 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.lib/utils/hash.py+3
warningLarge base64-encoded blobA 128-character base64 blob was found. May hide a remote payload or encoded executable code.lib/utils/hash.py
78ddc8555bb1677ff5af75ba5fc02cb30bb592b0610277ae15055e189b77...
+3
warningLarge hex-encoded blobA 142-character hex blob was found. Often used to hide shellcode or C2 addresses.lib/utils/hash.py
0x02004086ceb6eb051cdbc5bdae68ffc66c918d4977e592f6bdfc2b444a...
+3
warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.lib/utils/jwt.py+3
warningLarge base64-encoded blobA 92-character base64 blob was found. May hide a remote payload or encoded executable code.extra/dbwire/firebird.py
BF7A96D4A93B55D488DF099A15C89DCB0640738EB2CBDD9A8F7BAB561AB1...
+3
warningLarge hex-encoded blobA 93-character hex blob was found. Often used to hide shellcode or C2 addresses.extra/dbwire/firebird.py
E67D2E994B2F900C3F41F08F5BB2627ED0D49EE1FE767A52EFCD565CD6E7...
+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.lib/core/settings.py+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.lib/core/testing.py+3
warningLarge hex-encoded blobA 86-character hex blob was found. Often used to hide shellcode or C2 addresses.lib/request/dns.py
6509012000010000000000010377777706676f6f676c6503636f6d000001...
+3
warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.lib/techniques/ssti/inject.py+3

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

710 files scanned @ 11afdcb | 10/22/2026 | heuristic scan — always review manually

risk by category
code execution25
network & exfiltration20
file system access0
obfuscation15
supply chain0
owasp / injection0
telemetry
files 710/895rules hit 26engine v7commit 11afdcb

github

sqlmapproject/sqlmap

Automatic SQL injection and database takeover tool

Python
38769
6417
5237d
895 files
710 scanned(79%)
11afdcb

architecture░▒▓

entry (0) flagged (24) pkg (506)
906 nodes · 2543 edgesscroll to zoom · click node to jump to finding