Detection & Exploitation Of SQL Injection Flaws - Safe3 SQL Injector

SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker.

The following script shows a simple SQL injection. The script builds an SQL query by concatenating hard-coded strings together with a string entered by the user:

var username;
username = Request.form ("username");
var sql = "select * from OrdersTable where username = '" + username + "'";

The user is prompted to enter the name. If he enters nikesh, the query assembled by the script looks similar to the following:

SELECT * FROM OrdersTable WHERE username = 'nikesh'

However, assume that the user enters the following:

nikesh'; drop table usersTable--

In this case, the following query is assembled by the script:

SELECT * FROM OrdersTable WHERE username = 'nikesh';drop table usersTable--'

The semicolon (;) denotes the end of one query and the start of another. The double hyphen (--) indicates that the rest of the current line is a comment and should be ignored.

If the modified code is syntactically correct, it will be executed by the server. When SQL Server processes this statement, SQL Server will first select all records in OrdersTable where username is nikesh. Then, SQL Server will drop usersTable.

USE THIS TOOL FOR LEGAL PURPOSES ONLY!

Safe3 SQL Injector is one of the most powerful penetration testing tool that automates the process of detecting and exploiting SQL injection flaws (as shown above) and taking over of back-end database servers.

Safe3 SQL Injector Features:
  * Full support for GET/Post/Cookie Injection;
  * Full support for HTTP Basic, Digest, NTLM and Certificate authentications
  * Full support for MySQL, Oracle, PostgreSQL,MSSQL,ACESS,DB2,Sybase,Sqlite
  * Full support for Error/Union/Blind/Force SQL injection
  * Support for file acess,command execute,ip domain reverse,web path guess,md5 crack,etc.
  * Super bypass WAF 

You can download Safe3 SQL Injector here: Safe3SI.6.2.rar

Read More

Automatic SQL Injection Exploitation Tool - TheMole

Author is not responsible for any damage or illegal actions caused by the use of this program.
Use on your own risk!

SQL injection is yet another common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at your site’s visitors, SQL injection is an attack on the site itself—in particular its database. The goal of SQL injection is to insert arbitrary data, most often a database query, into a string that’s eventually executed by the database. The insidious query may attempt any number of actions, from retrieving alternate data, to modifying or removing information from the database.

TheMole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique.

TheMole Features
 * Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
 * Command line interface. Different commands trigger different actions.
 * Auto-completion for commands, command arguments and database, table and columns names.
 * Support for query filters, in order to bypass certain IPS/IDS rules using generic filters, and the  possibility of creating new ones easily.
 * Developed in python 3.

Continue Reading...

Read More

SQL injection Tool - Havij

We are NOT responsible for any damage or illegal actions caused by the use of this program. 
Use on your own risk!

SQL injection is yet another common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at your site’s visitors, SQL injection is an attack on the site itself—in particular its database. The goal of SQL injection is to insert arbitrary data, most often a database query, into a string that’s eventually executed by the database. The insidious query may attempt any number of actions, from retrieving alternate data, to modifying or removing information from the database

Continue Reading...

Read More

Tool to Detect SQL Injection - SQLInject-Finder

SQL injection is yet another common vulnerability that is the result of lax input validation. Unlike cross-site scripting vulnerabilities that are ultimately directed at your site’s visitors, SQL injection is an attack on the site itself—in particular its database. The goal of SQL injection is to insert arbitrary data, most often a database query, into a string that’s eventually executed by the database. The insidious query may attempt any number of actions, from retrieving alternate data, to modifying or removing information from the database.

Continue Reading...

Read More

Protect MySQL Database from SQL injection attacks - GreenSQL

GreenSQL is an Open Source database firewall used to protect databases from SQL injection attacks. GreenSQL works as a proxy and has built in support for MySQL and PostgreSQL. The logic is based on evaluation of SQL commands using a risk scoring matrix as well as blocking known db administrative commands (DROP, CREATE, etc).

GreenSQL works as a reverse proxy for MySQL connections. This means, that instead of connecting TO THE MySQL server, your applications will connect to the GreenSQL server. GreenSQL will analyze SQL queries and then, if they're safe, will forward them to the back-end MySQL server.

Continue Reading...

Read More

Automatic SQL injection tool - sqlmap

Whatever you do with this tool is uniquely your responsibility. If you are not authorized to punch holes in the network you are attacking be aware that such action might get you in trouble with a lot of law enforcement agencies.

sqlmap goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specific DBMS tables/columns, run his own SQL statement, read specific files on the file system and more.

Continue Reading...

Read More

Web Application Vulnerability Scanner - Webvulscan

WebVulScan is a web application vulnerability scanner. It is a web application itself written in PHP and can be used to test remote, or local, web applications for security vulnerabilities. As a scan is running, details of the scan are dynamically updated to the user. These details include the status of the scan, the number of URLs found on the web application, the number of vulnerabilities found and details of the vulnerabilities found.

After a scan is complete, a detailed PDF report is emailed to the user. The report includes descriptions of the vulnerabilities found, recommendations and details of where and how each vulnerability was exploited.

The vulnerabilities tested by WebVulScan are:
 * Reflected Cross-Site Scripting
 * Stored Cross-Site Scripting
 * Standard SQL Injection
 * Broken Authentication using SQL Injection
 * Autocomplete Enabled on Password Fields
 * Potentially Insecure Direct Object References
 * Directory Listing Enabled
 * HTTP Banner Disclosure
 * SSL Certificate not Trusted
 * Unvalidated Redirects

Continue Reading...

Read More

Test the Security and Vulnerability of Web-Application - Vega

Vega is an open source platform to test the Security and Vulnerability of web applications. Vega can help you find and validate SQL Injections, Cross-Site Scripting (XSS), inadvertently disclosed sensitive information, and other vulnerabilities. It is written in Java, GUI based, and runs on Linux, OS X, and Windows.

Vega includes an automated scanner for quick tests and an intercepting proxy for tactical inspection. Vega can be extended using a powerful API in the language of the web: Javascript.

Modules used in Vega:
 * Cross Site Scripting (XSS)
 * SQL Injection
 * Directory Traversal
 * URL Injection
 * Error Detection
 * File Uploads
 * Sensitive Data Discover

Continue Reading...

Read More

Tool to Audit Web Application Security - Lilith

LiLith is a tool written in Perl to audit web applications. This tool analyses webpages and looks for html <form> tags , which often refer to dynamic pages that might be subject to SQL injection or other flaws.

How the entire "scanning" process works is different from so called "CGI scanners", such as nikto and n-stealth.  This program will surf to a website and crawls through all the links, just as a user would to.  On any possible input field, such as text boxes, page id's, ... LiLith will attempt to inject any  characters  that might have a special meaning for any underlying technology, such as SQL. 

Any Web applications scanner can never perform a full 100% correct audit. Therefore, a manual re-check is necessary. Hence, be aware that Lilith might come up with several false positives.

Continue Reading...

Read More

Framework to Find and Exploit web Application Vulnerabilities - w3af

You may use this tool at your own risk!

w3af is a Web Application Attack and Audit Framework which aims to identify and exploit all web application vulnerabilities.

The framework has been called the "metasploit for the web", but it's actually much more than that, because it also discovers the web application vulnerabilities using black-box scanning techniques!

The w3af core and it's plugins are fully written in Python. The project has more than 130 plugins, which identify and exploit SQL injection, cross site scripting (XSS), remote file inclusion and more.

Continue Reading...

Read More

Learning Web Application Security (hacking) with DVWA on Linux

Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

DO NOT USE THIS ON A LIVE ENVIRONMENT

In its latest release (version 1.0.6), it has the following vulnerabilities :
  * SQL Injection
  * XSS Stored/Reflected
  * LFI (Local File Inclusion)
  * RFI (Remote File Inclusion)
  * Command Execution
  * Upload Script
  * Login Brute Force
  * Full Path Disclosure
  * PHP-IDS
And much more...

Installation:
Download the latest version - here
Simply unzip dvwa.zip, place the unzipped files in your public html folder, then point your browser to http://127.0.0.1/dvwa/index.php

Default username = admin
Default password = password

Database Setup
To set up the database, simply click on the Setup button in the main menu, then click on the ’Create / Reset Database’ button. This will create / reset the database for you with some data in.

If you receive an error while trying to create your database, make sure your database credentials are correct within /config/config.inc.php

$_DVWA[ 'db_user' ] = 'your_database_username';
$_DVWA[ 'db_password' ] = 'your_database_password';
$_DVWA[ 'db_database' ] = 'your_database_name';

More information, Official Web Site: DVWA

Disclaimer
We do not take responsibility for the way in which any one uses Damn Vulnerable Web App (DVWA). We have made the purposes of the application clear and it should not be used maliciously. We have given warnings and taken measures to prevent users from installing DVWA on to live web servers. If your web server is compromised via an installation of DVWA it is not our responsibility it is the responsibility of the person/s who uploaded and installed it.

Read More

Free Guide - Web Application Security; How to Minimize Prevalent Risk of Attacks

"Web Application Security; How to Minimize Prevalent Risk of Attacks"

Vulnerabilities in web applications are now the largest vector of enterprise security attacks.

Stories about exploits that compromise sensitive data frequently mention culprits such as "cross-site scripting," "SQL injection," and "buffer overflow." Vulnerabilities like these fall often outside the traditional expertise of network security managers.

To help you understand how to minimize these risks, Qualys provides this guide as a primer to web application security.

The guide covers:
 * Typical web application vulnerabilities
 * Comparison of options for web application vulnerability detection
 * QualysGuard Web Application Scanning solution

Download your free copy of "Web Application Security; How to Minimize Prevalent Risk of Attacks" - here

Read More