The Mole - Automatic SQL Injection Exploitation Tool

The Mole is an automatic SQL Injection exploitation tool. Only by providing a vulnerable URL and a valid string on the site it can detect the injection and exploit it, either by using the union technique or a boolean query based technique.

Features

• Support for injections using Mysql, SQL Server, Postgres and Oracle databases.
• Command line interface. Different commands trigger different actions.
• Auto-completion for commands, command arguments and database, table and columns names.
• Support for filters, in order to bypass certain IPS/IDS rules using generic filters, and the possibility of creating new ones easily.
• Exploits SQL Injections through GET/POST/Cookie parameters.
• Developed in python 3.
• Exploits SQL Injections that return binary data.
• Powerful command interpreter to simplify its usage.

Download The Mole

Read More

Simple SQLi Dumper v5.1 - Tool to find bugs, errors or vulnerabilities in MySQL database

SSDp is an usefull penetration tool to find bugs, errors or vulnerabilities in MySQL database.

Functions

• SQL Injection
• Operation System Function
• Dump Database
• Extract Database Schema
• Search Columns Name
• Read File (read only)
• Create File (read only)
• Brute Table & Column

Download Simple SQLi Dumper v5.1

Read More

[Havij 1.17] Automated and Advanced SQL Injection

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.

It can take advantage of a vulnerable web application. By using this software, user can perform back-end database fingerprinting, retrieve DBMS login names and password hashes, dump tables and columns, fetch data from the database, execute SQL statements against the server, and even access the underlying file system and execute operating system shell commands.

The distinctive power of Havij that differentiates it from similar tools lies in its unique methods of injection. The success rate of attack on vulnerable targets using Havij is above 95%.

The user friendly GUI (Graphical User Interface) of Havij and its automated configuration and heuristic detections make it easy to use for everyone even amateurs

What's New?

• Dump all.
• New bypass method for MySQL using parenthesis.
• Write file feature added for MSSQL and MySQL.
• Loading HTML form inputs.
• Saving data in CSV format.
• Advanced evasion tab in the settings.
• Injection tab in settings.
• 'Non-existent injection value' can now be changed by user (the default value is 999999.9).
• 'Comment mark' can be changed by user (the default value is --).
• Disabling/enabling of logging.
• Bugfix: adding manual database in tables tree view.
• Bugfix: finding string columns in PostgreSQL.
• Bugfix: MS Access blind string type data extraction
• Bugfix: MSSQL blind auto detection when error-based method fails
• Bugfix: all database blind methods fail on retry
• Bugfix: guessing columns/tables in MySQL time-based injection
• Bugfix: crashing when dumping into file
• Bugfix: loading project injection type (Integer or String)
• Bugfix: HTTPS multi-threading bug
• Bugfix: command execution in MSSQL 2005

Download Havij 1.17

Read More

[Netsparker v3.2] Web Application Security Scanner

Netsparker can crawl, attack and identify vulnerabilities in all custom web applications regardless of the platform and the technology they are built on, just like an actual attacker.

It can identify web application vulnerabilities like SQL Injection, Cross-site Scripting (XSS), Remote Code Execution and many more. It has exploitation built on it, for example you can get a reverse shell out of an identified SQL Injection or extract data via running custom SQL queries.

The main highlight of this version is the web services scanner; now scan and identify vulnerabilities and security issues in web services automatically and easily.

Changelog v3.2

New Features

• Ability to scan SOAP web services for security issues and vulnerabilities
• Request and Response viewers to view HTTP requests/responses like XML and JSON tree views
• New knowledge base node that will include all AJAX/XML HTTP Requests
• New value matching options for form values other than regex pattern (exact, contains, starts, ends)
• New report template for parsing source information Crawled URLs List (CSV)

New Security Checks

• Added attack patterns for LFI vulnerability which is revealed with only backslashes in file path
• Added Programming Error Message vulnerability detection for SOAP faults
• Added AutoComplete vulnerability for password inputs
• NuSOAP version disclosure
• NuSOAP version check

Improvements

• Improved XSS vulnerability confirmation
• Improved Generic Source Code Disclosure security check by excluding JavaScript and CSS resources
• Added latest version custom field for the version vulnerabilities
• Added standard context menus to text editors
• Sitemap tree will displan nodes of JSON, XML and SOAP requests and responses with no parameters
• Added force option to form value settings to enforce user specified values
• Optimized attack patterns for JSON and XML attacks by reducing attack requests
• Optimized Common Directories list and removed the limit for Extensive Security Checks policy
• Improved the license dialog to show whether a license is missing or expired

Fixes

• Fixed update dialog to not show on autopilot mode
• Fixed an interim auto update crash
• Fixed typo in Out of Scope Links knowledge base report template
• Fixed an issue in LFI exploiter where XML tags with namespace prefixes was preventing exploitation
• Fixed Controlled Scan button disabled issue for some sitemap nodes
• Fixed parameter anchors in Vulnerability Summary table of Detailed Scan Report template
• Fixed form authentication wizard to use user agent set on currently selected policy
• Fixed zero response time issue for some sitemap nodes
• Fixed dashboard progress bar showing 100%
• Fixed random crashes on license dialog while loading license file or closing dialog
• Fixed Microsoft Anti-XSS Library links on vulnerability references

Download Netsparker v3.2

Read More