nu11secur1ty/kouseiPython/Go framework that generates SQL injection PoC requests, automates sqlmap attacks, and manages modular exploit scripts with parameter detection and cleanup.
Author: nu11secur1ty
Years: 2023–2026
Language: Python (with optional Go modules)
Purpose: Generate SQLi Proof-of-Concept requests, automate sqlmap attacks, and manage attack modules with ease.
Kousei (こうせい) is an aggressive framework for sqlmap that can work with any web scanner capable of generating POST, GET, or other HTTP requests. It is a command-line utility that simplifies the process of crafting and executing SQL injection Proof-of-Concept (PoC) attacks using sqlmap. It combines Go and Python modules to generate exploit requests, launch sqlmap with advanced parameters, and manage auxiliary attack scripts.
exploit.txt).URLi and User-Agent.colorama Python packageYour_dir\sqlmap-nu11secur1ty\sqlmap.py)Clone the repository:
git clone https://github.com/nu11secur1ty/Kousei.git
cd Kousei
Install Python dependencies:
pip install colorama
Ensure Go is installed and in your system PATH.
Verify your sqlmap.py path in the Python script (kousei.py) and adjust it if needed.
Run the main Python program:
python kousei.py
You will see a menu:
===== Kousei Menu =====
1. Generate PoC (exploit.txt)
2. Start sqlmap with PoC
3. Run module: modules/URLi.py
4. Run module: modules/User-Agent.py
5. Run module: modules/HashCracker.py
6. View metadata (modules/exploit_meta.json)
7. Clean evidence (delete exploit.txt and metadata)
8. Exit
Choose an option by typing the corresponding number.
When using --create or the interactive menu, paste the full raw HTTP request. The tool expects the payload to start with POST or GET (first line) and a blank line separating headers from body.
Example PoC payload:
POST /login.php HTTP/1.1
Host: vulnerablehost.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=123456
username=admin&password=pass
The tool will:
exploit.txt (root) and modules/exploit.txt with a small comment header.modules/exploit_meta.json for later use.If modules/exploit_meta.json contains vuln_params, the tool will include:
-p param1,param2
when starting sqlmap, focusing tests on those parameters.
Use the menu option or CLI --clean to delete:
exploit.txt (root)modules/exploit.txtmodules/exploit_meta.jsonThis helps remove quick evidence of the test payloads. Note: some system logs may still remain outside this tool’s control.
A small pytest suite is included for the parameter detection routine.
Run tests:
pip install pytest
pytest -q
kousei.log (rotating).--verbose) to increase log detail and stream logs to console.2023–2026 — Initial project, CLI + interactive menu, PoC creation, sqlmap integration.
2026 — Polished: metadata file, auto parameter detection, logging, argparse CLI, unit tests.
This project is licensed under GPL-3.0. Preserve license notices and attribution when redistributing.
This software is intended exclusively for authorized security testing and education. The author is not responsible for misuse. Always obtain explicit, written permission before testing any target systems.
Enjoy hacking responsibly. ☠️