SQL INJECTION

Sqlmap 0.7 Released ~ Automatic SQL Injection Tool

sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.

Recent Changes

Along all the takeover features introduced in sqlmap 0.7 release candidate 1, some of the new features include:

• Adapted Metasploit wrapping functions to work with latest 3.3 development version too.
• Adjusted code to make sqlmap 0.7 to work again on Mac OSX too.
• Reset takeover OOB features (if any of –os-pwn, –os-smbrelay or –os-bof is selected) when running under Windows because msfconsole and msfcli are not supported on the native Windows Ruby interpreter.
• This make sqlmap 0.7 to work again on Windows too.
• Minor improvement so that sqlmap tests also all parameters with no value (eg. par=).
• HTTPS requests over HTTP proxy now work on either Python 2.4, 2.5 and 2.6+.

Download: Here

~~~~~~~~~~~~~~~~~~~~~~

MultiInjector v0.3

So, if i’ve posted about this tool Here a few months ago. But today we have the latest version of this program.

Features

• Receives a list of URLs as input
• Recognizes the parameterized URLs from the list
• Fuzzes all URL parameters to concatenate the desired payload once an injection is successful
• Automatic defacement - you decide on the defacement content, be it a hidden script, or just pure old “cyber graffiti” fun
• OS command execution - remote enabling of XP_CMDSHELL on SQL server, subsequently running any arbitrary operating system command lines entered by the user
• Configurable parallel connections exponentially speed up the attack process - one payload, multiple targets, simultaneous attacks
• Optional use of an HTTP proxy to mask the origin of the attacks

CHANGELOG

• Automatic defacement - Try to concatenate a string to all user-defined text fields in DB
• Run any OS command as if you’re running a command console on the DB machine
• Execute SQL commands of your choice
• Enable OS shell procedure on DB - Revive the good old XP_CMDSHELL where it was turned off
• Add administrative user to DB server with password: T0pSeKret
• Enable remote desktop on DB server
• Fixed nvarchar cast to varchar. Verified against MS-SQL 2000
• Added numeric / string parameter type detection
• Improved defacement content handling by escaping quotation marks
• Improved support for Linux systems
• Fixed the “invalid number of concurrent connections” failure due to non-parameterized URLs

Download: Here

Read more: Here

~~~~~~~~~~~~~~~~~~~~~~

BSQL - SQL INJECTION Fremework / Tool

BSQL (Blind SQL) Hacker is an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities virtually in any database.

BSQL Hacker aims for experienced users as well as beginners who want to automate SQL Injections (especially Blind SQL Injections).

It allows metasploit alike exploit repository to share and update exploits.

It ships with Automated Attack modules which allows the dumping of whole databases for the following DBMS:

• MS-SQL Server
• ORACLE
• MySQL (experimental)

Attack Templates for:

• MS Access
• MySQL
• ORACLE
• PostgreSQL
• MS-SQL Server

Download: Here

~~~~~~~~~~~~~~~~


WITOOL v.1.0


WITOOL is SQL injection tool by .NET (2.0).

- For SQL Server, Oracle
- Error Base and Union Base

Environment

OS : Windows 2000/XP/2003/VISTA
Requirement : .NET(2.0) library (DOWN)

Download: here
~~~~~~~~~~~~~~~~

m4x sql injection tools download

m4x mysql injector more faster than similar programs because it uses different methods
It has proxy selection according to user choice.
Datas getting one to one like the other database management systems or scripts.
You can make your listing process faster because it's include Treeview control
It's include data limit.It's mean you can get data with what you decide about that 
You can get datas from end(desc) or from start(asc)
You can see how much time left to end process with progressbar.
You can export your datas to Microsoft Excel
If you want do your half work later you can do it easyly with saving your database
If the m4x mysql injector have database user's permissions, you can execute load_file,
into outfile and into dumpfile functions.You can read file which do you want with load file
and you can write your shell to directory which do you want with into out
It doesn't affect with Magic Quotes Gpc.It doesn't matter on or off

m4x mysql injector demonstration (How to use video)
m4x mssql injector demonstration (How to use video)

Download here