OWASP Backend Security Project Tools - Revision history

Inquis at 12:28, 13 September 2009

2009-09-13T12:28:56Z

Leocavallari at 17:51, 5 March 2009

2009-03-05T17:51:41Z

Carlo.pelliccioni: /* Tools */

2008-10-21T01:19:32Z

‎Tools

Carlo.pelliccioni: /* SQID SQL Injection Digger */

2008-10-21T01:18:55Z

‎SQID SQL Injection Digger

Carlo.pelliccioni: /* Tools */

2008-10-21T01:18:37Z

‎Tools

Carlo.pelliccioni: /* [http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools Tools] */

2008-09-01T09:43:50Z

‎[http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools Tools]

Carlo.pelliccioni: /* SQL Injection Pentesting Tool */

2008-09-01T09:43:24Z

‎SQL Injection Pentesting Tool

Carlo.pelliccioni: /* [http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools Tools] */

2008-09-01T09:42:44Z

‎[http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools Tools]

Carlo.pelliccioni: /* [http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools Tools] */

2008-09-01T09:37:03Z

‎[http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools Tools]

Carlo.pelliccioni: /* Web Application Vulnerability Scanners */

2008-09-01T09:36:43Z

‎Web Application Vulnerability Scanners

@@ Line 14: / Line 14: @@
 == SQLMap ==
-SQLMap is a Python application able to collect information and data, such as databases names, table’s names and contents, and read system files from a MySQL, Oracle, PostgreSQL or Microsoft SQL Server Database Management Systems, exploiting the SQL Injection vulnerability of a vulnerable web application.
+sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.
 http://sqlmap.sourceforge.net

← Older revision		Revision as of 17:51, 5 March 2009
Line 1:		Line 1:
		+	[[Category:OWASP Backend Security Project]]
		+
		+
	= Tools =		= Tools =

@@ Line 37: / Line 37: @@
 http://sqid.rubyforge.org
-=== SqlDumper ===
+== SqlDumper ==
 Exploiting a SQL injection vulnerability SqlDumper can make dump of any file in the file system. It work only with DBMS MySql.
@@ Line 43: / Line 43: @@
 http://www.ictsc.it/site/IT/projects/sqlDumper/sqlDumper.php
-=== SQL Power Injector ===
+== SQL Power Injector ==
 SQL Power Injector is a .Net 1.1 application used to find and exploit SQL Injection vulnerability through a vulnerable web application which uses SQL Server, MySql, Sybase/Adaptive Server and DB2 Database Management Systems as backend. It’s main feature is the support for multithreaded automation of the injection.
@@ Line 49: / Line 49: @@
 http://www.sqlpowerinjector.com
-=== BobCat ===
+== BobCat ==
 BobCat is a tool based on “Data Thief” and realized in .NET 2.0. It permits to take full advantage of SQL Injection vulnerability discovered in a web application to steal data, gain a shell or a reverse shell on the database management system machine. It has been tested on MSDE2000.
 http://www.northern-monkee.co.uk/index.html

@@ Line 27: / Line 27: @@
 http://www.imperva.com/products/scuba.html
-=== SQID SQL Injection Digger ===
+== SQID SQL Injection Digger ==
 SQL injection digger is a command line program, written in [http://www.ruby-lang.org/ ruby], that looks for SQL injections and common errors in websites. It can perform the following operations:

@@ Line 1: / Line 1: @@
-== Tools ==
+= Tools =
 The aim of this section is to enumerate and quickly describe the tools used to find and exploit some vulnerabilities concerning database management systems.
-=== SQL Ninja ===
+== SQL Ninja ==
 SQL Ninja is a tool, written in Perl, which helps a penetration tester to gain a shell on a  system running Microsoft SQL server, exploiting a web application resulted vulnerable to SQL Injection.
@@ Line 9: / Line 9: @@
 http://sqlninja.sourceforge.net
-=== SQLMap ===
+== SQLMap ==
 SQLMap is a Python application able to collect information and data, such as databases names, table’s names and contents, and read system files from a MySQL, Oracle, PostgreSQL or Microsoft SQL Server Database Management Systems, exploiting the SQL Injection vulnerability of a vulnerable web application.
@@ Line 15: / Line 15: @@
 http://sqlmap.sourceforge.net
-=== OWASP SQLiX ===
+== OWASP SQLiX ==
 SQLiX is a tool, written in Perl, able to identify the back-end database, find blind and normal injection and also execute system commands on a Microsoft SQL Server. It was also successfully tested on MySQL and PostgreSQL.
@@ Line 21: / Line 21: @@
 http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project
-=== Scuba ===
+== Scuba ==
 Scuba is a Database vulnerability scanner able to find vulnerabilities like unpatched software, unsafe processes and weak password on Oracle, DB2, Microsoft SQL Server and Sybase.

← Older revision		Revision as of 09:43, 1 September 2008
Line 1:		Line 1:
−	== ~~[http://www.owasp.org/index.php/OWASP_Backend_Security_Project_Tools~~ Tools] ==	+	== Tools ==

	The aim of this section is to enumerate and quickly describe the tools used to find and exploit some vulnerabilities concerning database management systems.		The aim of this section is to enumerate and quickly describe the tools used to find and exploit some vulnerabilities concerning database management systems.

← Older revision		Revision as of 09:43, 1 September 2008
Line 52:		Line 52:
	BobCat is a tool based on “Data Thief” and realized in .NET 2.0. It permits to take full advantage of SQL Injection vulnerability discovered in a web application to steal data, gain a shell or a reverse shell on the database management system machine. It has been tested on MSDE2000.		BobCat is a tool based on “Data Thief” and realized in .NET 2.0. It permits to take full advantage of SQL Injection vulnerability discovered in a web application to steal data, gain a shell or a reverse shell on the database management system machine. It has been tested on MSDE2000.

−	http://www.northern-monkee.co.uk/index~~.html~~	+	http://www.northern-monkee.co.uk/index.html
−
−	~~=== SQL Injection Pentesting Tool ===~~
−
−	SQL Injection Tool is an application used to exploit SQL Injection vulnerability found in a web application, it’s able to retrieve some useful information and data from a Microsoft SQL server. It also includes a terminal to send raw HTTP requests.
−
−	~~http://sqltool.itdefence.ru/indexeng~~.html

@@ Line 3: / Line 3: @@
 The aim of this section is to enumerate and quickly describe the tools used to find and exploit some vulnerabilities concerning database management systems.
-==== [http://sqlninja.sourceforge.net SQL Ninja] ====
+=== SQL Ninja ===
 SQL Ninja is a tool, written in Perl, which helps a penetration tester to gain a shell on a  system running Microsoft SQL server, exploiting a web application resulted vulnerable to SQL Injection.
-==== [http://sqlmap.sourceforge.net SQLMap] ====
 SQLMap is a Python application able to collect information and data, such as databases names, table’s names and contents, and read system files from a MySQL, Oracle, PostgreSQL or Microsoft SQL Server Database Management Systems, exploiting the SQL Injection vulnerability of a vulnerable web application.
-==== [http://www.owasp.org/index.php/Category:OWASP_SQLiX_Project OWASP SQLiX] ====
 SQLiX is a tool, written in Perl, able to identify the back-end database, find blind and normal injection and also execute system commands on a Microsoft SQL Server. It was also successfully tested on MySQL and PostgreSQL.
-==== [http://www.imperva.com/products/scuba.html Scuba] ====
 Scuba is a Database vulnerability scanner able to find vulnerabilities like unpatched software, unsafe processes and weak password on Oracle, DB2, Microsoft SQL Server and Sybase.
-==== [http://sqid.rubyforge.org/ SQID SQL Injection Digger] ====
 SQL injection digger is a command line program, written in [http://www.ruby-lang.org/ ruby], that looks for SQL injections and common errors in websites. It can perform the following operations:
 * Look for SQL injection in a webpage, by looking for links
@@ Line 17: / Line 33: @@
 * Crawl a website to perform the above listed operations
 * Perform a google search for a query and look for SQL injections in the urls found
-==== [http://www.ictsc.it/site/IT/projects/sqlDumper/sqlDumper.php SqlDumper] ====
 Exploiting a SQL injection vulnerability SqlDumper can make dump of any file in the file system. It work only with DBMS MySql.
-==== [http://www.sqlpowerinjector.com SQL Power Injector] ====
 SQL Power Injector is a .Net 1.1 application used to find and exploit SQL Injection vulnerability through a vulnerable web application which uses SQL Server, MySql, Sybase/Adaptive Server and DB2 Database Management Systems as backend. It’s main feature is the support for multithreaded automation of the injection.
-==== [http://www.northern-monkee.co.uk/index.html BobCat] ====
 BobCat is a tool based on “Data Thief” and realized in .NET 2.0. It permits to take full advantage of SQL Injection vulnerability discovered in a web application to steal data, gain a shell or a reverse shell on the database management system machine. It has been tested on MSDE2000.
-==== [http://sqltool.itdefence.ru/indexeng.html SQL Injection Pentesting Tool] ====
 SQL Injection Tool is an application used to exploit SQL Injection vulnerability found in a web application, it’s able to retrieve some useful information and data from a Microsoft SQL server. It also includes a terminal to send raw HTTP requests.

← Older revision		Revision as of 09:36, 1 September 2008
Line 26:		Line 26:
	==== [http://sqltool.itdefence.ru/indexeng.html SQL Injection Pentesting Tool] ====		==== [http://sqltool.itdefence.ru/indexeng.html SQL Injection Pentesting Tool] ====
	SQL Injection Tool is an application used to exploit SQL Injection vulnerability found in a web application, it’s able to retrieve some useful information and data from a Microsoft SQL server. It also includes a terminal to send raw HTTP requests.		SQL Injection Tool is an application used to exploit SQL Injection vulnerability found in a web application, it’s able to retrieve some useful information and data from a Microsoft SQL server. It also includes a terminal to send raw HTTP requests.
−
−
−
−	~~== Web Application Vulnerability Scanners ==~~
−	~~''' The web application vulnerability scanners listed below are able to discover SQL Injection vulnerability: '''~~
−	~~- [http://www.watchfire.com Appscan]~~
−	~~- [http://www.cenzic.com Hailstorm]~~
−	~~- [http://www.whitehatsec.com/services.shtml Sentinel]~~
−	~~- [http://www.spydynamics.com/products/webinspect/toolkit.html SQL Injector (SPI Toolkit)]~~