[Havij 1.17] Automated and Advanced SQL Injection

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software, user can perform back-end database fingerprinting, retrieve DBMS login names and password hashes, dump tables and columns, fetch data from the database, execute SQL statements against the server, and even access the underlying file system and execute operating system shell commands.

The distinctive power of Havij that differentiates it from similar tools lies in its unique methods of injection. The success rate of attack on vulnerable targets using Havij is above 95%.

The user friendly GUI (Graphical User Interface) of Havij and its automated configuration and heuristic detections make it easy to use for everyone even amateurs

What's New?

• Dump all.
• New bypass method for MySQL using parenthesis.
• Write file feature added for MSSQL and MySQL.
• Loading HTML form inputs.
• Saving data in CSV format.
• Advanced evasion tab in the settings.
• Injection tab in settings.
• 'Non-existent injection value' can now be changed by user (the default value is 999999.9).
• 'Comment mark' can be changed by user (the default value is --).
• Disabling/enabling of logging.
• Bugfix: adding manual database in tables tree view.
• Bugfix: finding string columns in PostgreSQL.
• Bugfix: MS Access blind string type data extraction
• Bugfix: MSSQL blind auto detection when error-based method fails
• Bugfix: all database blind methods fail on retry
• Bugfix: guessing columns/tables in MySQL time-based injection
• Bugfix: crashing when dumping into file
• Bugfix: loading project injection type (Integer or String)
• Bugfix: HTTPS multi-threading bug
• Bugfix: command execution in MSSQL 2005

Download Havij 1.17

[SQL injection test environment] A collection of web pages vulnerable to SQL injection flaws

A collection of web pages vulnerable to SQL injection flaws and more:

• conf/ - operating system configuration files used by deployment.sh.
• dbs/ - standalone databases for some database management systems (e.g. Microsoft Access).
• libs/ - web API libraries to connect to the database management system, perform the provided statement and return its output.
• schema/ - SQL used to create the test database, a test table and populate it with test entries.
• Other directories - vulnerable pages for each database management system.
• deployment.sh - A bash script to deploy from scratch a fully-fledged Linux (Debian or Ubuntu) machine with all the relevant database management systems installed and configured, ready to be targeted.

SQL injection test environment

[aidSQL] PHP Application For SQL Injection Detection & Exploitation

aidSQL a PHP application provided for detecting security holes in your website/s. It’s a modular application, meaning that you can develop your very own plugins for SQL injection detection & exploitation.

The tool provides pen-testing capabilities for MS-SQL 2000, MySQL 5 and the author promises to add Oracle 10g support – but that doesn’t seem to be happening.

You can view a demo of the app here:

The output from Wavsep for aidSQL can also be seen here:
aidSQL vs Wavsep
Read more here.

Download aidSQL

[Laudanum] Collection of injectable files

Laudanum is a collection of injectable files, designed to be used in a pentest when SQL injection flaws are found and are in multiple languages for different environments.They provide functionality such as shell, DNS query, LDAP retrieval and others.

Download Laudanum

[jSQL Injection v0.5] Java tool for automatic database injection

jSQL Injection is a lightweight application used to find database information from a distant server.

jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

jSQL Injection change log - version 0.5

0.5

• SQL shell
• Uploader

0.4

• Admin page checker and preview
• Brute forcer (md5 mysql...)
• Coder (encode decode base64 hex md5...)

0.3

• Distant file reading
• Webshell deposit
• Terminal for webshell commands
• Configuration backup
• Update checker

0.2

• Time based algorithm
• Multi-thread control (start/pause/resume/stop)
• Shows URL calls

0.0 and 0.1

• GET, POST, header, cookie methods
• Normal, error based, blind algorithms
• Automatic best algorithm selection
• Progression bars
• Simple evasion
• Proxy setting
• Supports MySQL 

Download jSQL Injection v0.5

[aidSQL] A tool that will aid you when trying to find vulnerable spots in your site

Is a PHP application provided for detecting security holes in your website/s. It's a modular application, meaning that you can develop your very own plugins for SQL injection detection & exploitation.

2013-05-27

---

NEW aidSQL Release which supports MS SQL SERVER 2000 Database injection and reverse enginneering.

2013-05-23

---

SOON, new release with Ms SQL Reverse Engineering support

2012-09-12

---

Hey everyone! I just got back to business and I'm improving aidSQL's code structure plus adding some other functionality to it. I'm currently looking for people who can contribute doing BASH SCRIPTING. I'm now doing a small test site installer for using aidSQL locally and I'm in need of bash scripters, if you are one/known one, send me an email.

Download aidSQL

[jSQL Injection v0.4] Java tool for automatic database injection

jSQL Injection is a lightweight application used to find database information from a distant server.

jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

Version 0.4 features:

• GET, POST, header, cookie methods
• Normal, error based, blind, time based algorithms
• Automatic best algorithm selection
• Multi-thread control (start/pause/resume/stop)
• Progression bars
• Shows URL calls
• Simple evasion
• Proxy setting
• Distant file reading
• Webshell deposit
• Terminal for webshell commands
• Configuration backup
• Update checker
• Admin page checker
• Brute forcer (md5 mysql...)
• Coder (encode decode base64 hex md5...)
• Supports MySQL 

Download jSQL Injection v0.4

[SQLi Dorking] script en perl para búsqueda de SQLi

sqliDorking.pl es un script en Perl de Crozz Cyborg que busca páginas vulnerables a inyecciones SQL usando dorks de Google o Bing. También acepta lista de dominios.

Uso: sqliDorking.pl [-d/-bd ] -p [-l Links.txt]  [-f Logs.txt]

Opciones:
  -gd : Google Dork
  -bd : Bing Dork
  -l : Archivo con links para analizar
  -p : Numero de paginas para buscar
  -f : Archivo donde se guardaran los logs

Ejemplos de uso:
sqliDorking.pl -gd inurl:product.php?id= -p 3 -f VulneSQL.txt
sqliDorking.pl -l links.txt -f VulneSQL.txt
sqliDorking.pl -bd inurl:product.php?id= -p 3
sqliDorking.pl -l links.txt

Descargar SQLi Dorking

[DroidSQLi] MySQL Injection tool for Android

DroidSQLi is the first automated MySQL Injection tool for Android. It allows you to test your MySQL-based web application against SQL injection attacks.  

DroidSQLi supports the following injection techniques:
- Time based injection
- Blind injection
- Error based injection
- Normal injection

Download DroidSQLi