[bsqlbf Brute forcer] Automated Blind SQL Injection Attacking Tool

What is Blind SQL Injection

Some Websites are vulnerable to SQL Injection but the results of injection are not visible to the attacker.  In this situation, Blind SQL Injection is used. The page with the vulnerability may not be one that displays data but will display differently depending on the results of a logical statement injected into the legitimate SQL statement called for that page. This type of attack can become time-intensive because a new statement must be crafted for each bit recovered.

There are plenty of automated Blind Sql Injection tool available. Here i am introducing one of Tool named as bsqlbf(expanded as Blind Sql Injection Brute Forcer).

This tool is written in Perl and allows extraction of data from Blind SQL Injections. It accepts custom SQL queries as a command line parameter and it works for both integer and string based injections

Supported Database:

• MS-SQL
• MySQL
• PostgreSQL
• Oracle

The tool supports 8 attack modes:-

Type 0: Blind SQL Injection based on true and false conditions returned by back-end server

Type 1: Blind SQL Injection based on true and error(e.g syntax error) returned by back-end server.

Type 2: Blind SQL Injection in "order by" and "group by".

Type 3: extracting data with SYS privileges (ORACLE dbms_export_extension exploit)

Type 4: is O.S code execution (ORACLE dbms_export_extension exploit)

Type 5: is reading files (ORACLE dbms_export_extension exploit, based on java)

Type 6: is O.S code execution DBMS_REPCAT_RPC.VALIDATE_REMOTE_RC exploit

Type 7: is O.S code execution SYS.KUPP$PROC.CREATE_MASTER_PROCESS(), DBA Privs

      -cmd=revshell Type 7 supports meterpreter payload execution, run generator.exe first

Type 8: is O.S code execution DBMS_JAVA_TEST.FUNCALL, with JAVA IO Permissions

     -cmd=revshell Type 8 supports meterpreter payload execution, run generator.exe first

For Type 4(O.S code execution) the following methods are supported:

-stype: How you want to execute command:

SType 0 (default) is based on java..will NOT work against XE. 

SType 1 is against oracle 9 with plsql_native_make_utility. 

SType 2 is against oracle 10 with dbms_scheduler.

Download

Only for Educational Purpose

Read more

SQL Injection Tool to test the Vulnerability for Pen Testers

SQL Inject Me is Mozilla addon that is used to test the SQL Injection Vulnerability of Web Application.  It reduces the workload of Manual SQL Injection Test.  This is especially designed for Pen Testers and Web Masters not for hackers.

Download

Working
The tool works by submitting your HTML forms and substituting the form value with strings that are representative of an SQL Injection attack.

The tool works by sending database escape strings through the form fields. It then looks for database error messages that are output into the rendered HTML of the page.

The tool does not attempting to compromise the security of the given system. It looks for possible entry points for an attack against the system. There is no port scanning, packet sniffing, password hacking or firewall attacks done by the tool.

Read more

NTO SQL Invader : Free Sql Injection Vulnerability scanning & Exploiting Tool

NT Objectives, A security application provider released a new SQL Injection Vulnerability Scanner, it will be very helpful for Penetration Testers to find the Vulnerabilities in Web Application.

"NTO SQL Invader" which scans for Sql injection vulnerability and exploits the Sql Injection vulnerability with few simple clicks. It is free to use..! NTO SQL Invader allows pen testers and developers to quickly and easily leverage a vulnerability to view the list of records, tables and user accounts on the back-end database.

Features:

• Easy to use - The tool’s GUI interface enables you to simply paste the injectable request found by a DAST tool or feed a detailed request straight from an application scan report. You can then control how much information is harvested.
• Clearly presents evidence - Unlike tools that provide all data via command line, NTO SQL Invader provides the data in a organized manner that is useful for both executive meetings as well as technical analysis and re mediation.
• Enables easy transport of logging data - All of the data harvested from NTO SQL Invader can be saved into a CSV file so the reports can be included as penetration evidence as part of a presentation or POC.

You can download the tool from here:
http://go.ntobjectives.com/l/8672/2011-12-01/DRMN

In order to get the application , you have to enter your email address. They will send the link to the application.

I got only NTOSQLInvader_Setup.exe file. I think you know that ".exe" files works only in Windows.

(You can also run the .exe files in Linux using Wine Application).

How to run the SQL Invader in Linux?
Requirements:
JRE 1.4 or 1.5 or 1.6 version

Step 1:
Download the .exe file from the given link. 
Place it in desktop.

Step 2: 
Right click on the NTOSQLInvader_Setup.exe file and click the extract here .

Now you can find a NTOSQLInvader_Setup folder in your desktop. 

Step 3:
Open the folder ,there you can see three files . We are going to need "NTOSQLInvader.jar " file only. So delete other two files.

Step 4:
That's all , copy the .jar file anywhere else or leave it in Dekstop itself.
Double click the file it will start to run.
Enjoy the application in Linux also...!!

You can run the NTOSQLInvader.jar file alone in any operating system(windows,mac,...), if you installed JRE.

Read more