pythia-sql-clairvoyance

---

In Action

HTML report — findings overview with severity badges and OWASP mapping

Findings table — PYTHIA-SQL codes, DBMS detection, CWE-89 mapping

---

What is Pythia?

Pythia is a production-ready SQL injection detection scanner that puts ethics first. Built for penetration testers, security researchers, and DevSecOps engineers, it identifies SQL injection vulnerabilities across 6 detection methods and integrates directly into CI/CD pipelines.

Why Pythia?

• Ethical by Design: Consent token system prevents unauthorized scanning
• Multi-Method Detection: 6 detection techniques including second-order and ORDER BY injection
• AI-Powered: GPT, Claude, or local Ollama for intelligent remediation guides with code examples
• CI/CD Ready: --fail-on, --sarif, --diff flags for pipeline integration
• Professional Reports: HTML with filter bar + OWASP/CWE/CVE badges + JSON with contextual CVSS scoring
• Persistent Tracking: SQLite database shared with Argos Suite (~/.argos/argos.db)
• High Accuracy: False positive hardening with similarity scoring and multi-payload confirmation

What It Detects

Detection Method	Description	Mode Required
Error-Based	SQL errors in responses (MySQL, PostgreSQL, MSSQL, Oracle, SQLite)	Safe
Boolean-Blind	Response differences from TRUE/FALSE conditions	Safe
Time-Based Blind	Response delays from SLEEP/WAITFOR payloads	Aggressive
UNION-Based	Data extraction via UNION SELECT	Aggressive
Second-Order	Store→retrieve injection patterns (POST→GET chain)	Aggressive
ORDER BY Injection	Numeric sort parameter injection	Aggressive

---

Features

Core SQL Injection Detection

# One command, comprehensive SQLi analysis
python -m pyth --target http://example.com/products?id=1 --html

• 14 Finding Codes: DBMS-specific (MySQL, PostgreSQL, MSSQL, Oracle, SQLite) + technique-specific
• DBMS Fingerprinting: Automatic database type and version detection
• WAF Bypass: 170+ bypass payloads in aggressive mode (hex, URL encoding, inline comments, case variants)
• Session-Variable Detection: POST→GET chain for DVWA-high style authentication patterns
• Smart Crawler: BFS with popup/onclick extraction (--js), sitemap, robots.txt
• False Positive Hardening: SequenceMatcher similarity scoring + multi-payload confirmation

CI/CD Integration

# Pipeline-friendly: exit 10 if high+ findings found
python -m pyth --target https://staging.app.com --aggressive --fail-on high
echo $?  # 0=clean, 10=findings found, 1=error

# SARIF for GitHub Security / GitLab SAST
python -m pyth --target https://app.com --aggressive --sarif > results.sarif

# Compare vs last scan — show what's new, what's fixed
python -m pyth --target https://app.com --aggressive --diff last --html

Auth Headers

# Scan authenticated endpoints (JWT, API keys, custom cookies)
python -m pyth --target https://api.example.com/v1/users \
  --auth-header "Authorization: Bearer eyJhbGc..." \
  --auth-header "X-API-Key: sk-prod-xxx" \
  --aggressive --html

Pass --auth-header multiple times for multiple headers.

AI-Powered Analysis

Choose your AI provider from the command line:

Provider	Best For	Speed	Cost	Privacy
OpenAI gpt-4o-mini (default)	Production quality, low cost	Fast	~$0.02/scan	Standard
Anthropic Claude	Privacy-focused, code remediation	Fast	~$0.06/scan	Enhanced
Ollama (Local)	Complete privacy	Slow (CPU)	Free	100% Offline

# Standard analysis
python -m pyth --target http://example.com --use-ai --ai-tone technical --html

# Agent mode: AI queries NVD for real CVEs (no API key for NVD)
python -m pyth --target http://example.com --use-ai --ai-agent --html

# Multi-provider comparison
python -m pyth --target http://example.com --use-ai \
  --ai-compare "openai:gpt-4o-mini,anthropic:claude-3-5-haiku-20241022" --html

# With budget cap
python -m pyth --target http://example.com --use-ai --ai-budget 0.05 --html

Professional Reporting

JSON Reports (Machine-Readable, v0.2.0 schema)