Large-Scale SQL Injection Campaign Using sqlmap and ghauri
By Threat Intelligence Unit
Overview
Oasis Security identified AI-assisted SQL injection activity through analysis of server-side artifacts collected from an exposed attack server.
The collected artifacts revealed the use of automated web vulnerability tools, including sqlmap and ghauri, to conduct SQL injection attacks against more than 100 websites across multiple sectors, including healthcare, government, telecommunications, media, and cloud infrastructure.
The analysis also identified evidence that the attacker leveraged Claude Code to refine attack techniques and support telecommunications-focused operations, providing insight into the attacker's tooling, targeting, and operational workflow.
Executive Summary
- Server-side artifacts revealed automated SQL injection activity targeting more than 100 websites
- sqlmap and ghauri were used to conduct large-scale SQL injection attacks, with successful exploitation confirmed against multiple targets
- Targeted organizations included healthcare providers, government networks, telecommunications companies, media organizations, cloud infrastructure, and enterprise services
- Claude Code was used to support offensive operations through iterative interactions involving attack-related prompts targeting telecommunications providers
- PDCP credentials and associated OSINT provided additional insight into the operator's external activity
Attacker Infrastructure Overview
Adversary Infrastructure
- Server IP:
62.171.148.163 - Country: Germany
The exposed server contained automation tools, attack histories, AI conversation records, and cloud platform credentials that provided visibility into the attacker's operational workflow.
Analysis of Attacks Using Web Vulnerability Tools
The exposed server contained evidence that the attacker conducted automated SQL injection attacks using sqlmap and ghauri.
sqlmap
The sqlmap history directory contained approximately 110 target subdirectories, as shown in the following figure.
Figure 1. Target subdirectories identified in the sqlmap history directory
Analysis of the corresponding logs confirmed successful SQL injection against approximately 12 websites.
The successfully exploited targets spanned multiple sectors, including:
| Sector | Representative Targets |
|---|---|
| Healthcare | German telemedicine platform and regional healthcare system |
| Government | Greek public-sector communications infrastructure |
| Telecommunications | French telecommunications enterprise network, Slovak telecommunications infrastructure |
| Media | Swiss radio station website |
| Financial Services | Currency exchange service |
| Smart Home | Australian home automation company |
| Consumer Services | Extended warranty and repair service platform |
| Real Estate | French real estate website |
Representative Target 1
- Target Website :
tel[REDACTED].t[REDACTED].net - Description: Telemedicine platform operated by a subsidiary of a major German telecommunications provider
![`sqlmap` log showing successful SQL injection against `tel[REDACTED].t[REDACTED].net`](/blog-images/260708/fig_2.webp)
Figure 2. sqlmap log showing successful SQL injection against tel[REDACTED].t[REDACTED].net
Representative Target 2
- Target Website :
r[REDACTED].r[REDACTED].ch - Description: Swiss radio station website
![`sqlmap` log showing successful SQL injection against `r[REDACTED].r[REDACTED].ch`](/blog-images/260708/fig_3.webp)
Figure 3. sqlmap log showing successful SQL injection against r[REDACTED].r[REDACTED].ch
ghauri
The ghauri history directory contained approximately 108 target subdirectories, as shown in the following figure.
Figure 4. Target subdirectories identified in the ghauri history directory
Analysis of the stored logs confirmed successful exploitation against approximately 22 websites.
Representative targets included:
| Sector | Representative Targets |
|---|---|
| Government | Benin government administrative infrastructure, Greek public-sector communications infrastructure |
| Cloud Infrastructure | European public cloud virtual server |
| Telecommunications | Hungarian telecommunications network, Croatian telecommunications infrastructure, German and Slovak telecommunications providers |
| Media | Swiss radio station and related web services |
| Hosting & Data Centers | Hungarian internet data center, Croatian hosting provider |
| Internet Infrastructure | Romanian internet backbone provider |
| Enterprise Services | European vehicle trading platform, clothing distribution management platform |
| Real Estate | French and German real estate websites |
| Community Services | Russian automobile forum |
Representative Target 1
- Target Website :
archives.mar[REDACTED].bj - Description: An official administrative domain hosted on Benin's national network infrastructure
![`ghauri` log showing successful SQL injection against `archives.mar[REDACTED].bj`](/blog-images/260708/fig_5.webp)
Figure 5. ghauri log showing successful SQL injection against archives.mar[REDACTED].bj
Representative Target 2
- Target Website :
www.mon[REDACTED].com - Description: French real estate information website
![`ghauri` log showing successful SQL injection against `www.mon[REDACTED].com`](/blog-images/260708/fig_6.webp)
Figure 6. ghauri log showing successful SQL injection against www.mon[REDACTED].com
AI-Assisted Attack Activity
Claude Code Conversation History
Claude Code conversation history showed that the attacker used the AI assistant to conduct offensive activities.
Figure 7. Claude Code conversation history showing AI-assisted offensive operations
The prompts focused primarily on attacks against telecommunications providers located in Germany and Hungary.
Figure 8. Conversation history containing attack prompts targeting telecommunications providers
Claude Code Paste Cache
Analysis of the Claude Code paste cache revealed additional prompts submitted to Claude Code.
Similar to the conversation history, these prompts instructed Claude Code to perform attacks targeting telecommunications providers.
Figure 9. Claude Code paste cache containing attack prompts
Telecommunications Domain List
Analysis of the file 813e7bdc4d0db2e0.txt identified approximately 260 domains associated with telecommunications providers.
Figure 10. Telecommunications domains identified in 813e7bdc4d0db2e0.txt
Operator Attribution
A credentials.yaml file was identified within the .pdcp directory.
The file contains authentication information used for the ProjectDiscovery Cloud Platform (PDCP).
PDCP provides cloud services supporting ProjectDiscovery tools including:
- Nuclei
- Subfinder
- httpx
Figure 11. Authentication information found in credentials.yaml file
Further investigation of the email address contained within the credential file led to the identification of an associated personal website.
Additional OSINT also identified an associated X (formerly Twitter) account that remained active until recently.
The available information indicates that the individual associated with the account participates in cybersecurity-related activities and projects.
Figure 12. Associated operator's personal website
Figure 13. Associated operator's X account
Conclusion
Analysis of the exposed server revealed a coordinated workflow combining automated SQL injection frameworks with generative AI assistance.
The attacker employed sqlmap and ghauri to conduct large-scale SQL injection campaigns while using Claude Code to generate and refine attack prompts targeting telecommunications providers.
The identified artifacts also contained cloud platform credentials and publicly accessible information associated with the operator, providing additional context beyond the attack infrastructure itself.
This case demonstrates how server-side artifacts can provide valuable intelligence into attacker tooling, targeting priorities, and operational workflows through the combined analysis of automation frameworks, AI-assisted development, and supporting infrastructure.