05 November 2008 | 11,501 views

MultiInjector – Automated Stealth SQL Injection Tool

MultiInjector claims to the first configurable automatic website defacement software, I’m not sure if that’s a good thing – or a bad thing.

But well here it is anyway.

Features

  • Receives a list of URLs as input
  • Recognizes the parameterized URLs from the list
  • Fuzzes all URL parameters to concatenate the desired payload once an injection is successful
  • Automatic defacement – you decide on the defacement content, be it a hidden script, or just pure old “cyber graffiti” fun
  • OS command execution – remote enabling of XP_CMDSHELL on SQL server, subsequently running any arbitrary operating system command lines entered by the user
  • Configurable parallel connections exponentially speed up the attack process – one payload, multiple targets, simultaneous attacks
  • Optional use of an HTTP proxy to mask the origin of the attacks

The author highly recommend running a HTTP sniffer such as IEInspector HTTP Analyzer in order to see all attack requests going out to the targets.

Requirements

  • Python >= 2.4
  • Pycurl (compatible with the above version of Python)
  • Psyco (compatible with the above version of Python)

You can download MultiInjector v0.2 here:

MultiInjector.py

Or read more here.


Tags: , , , , , , , ,
# Posted in: Database Hacking, Hacking Tools, Web Hacking | * 6 Comments


Recent in Database Hacking:
- The Mole v0.3 Released For Download – Automatic SQL Injection Exploitation Tool
- MySQL 1 Liner Hack Gives Root Access Without Password
- xSQLScanner – Database Password Cracker & Security Audit Tool For MS-SQL & MySQL

Related Posts:
- MultiInjector v0.3 Released – Automatic SQL Injection and Defacement Tool
- Havij – Advanced Automated SQL Injection Tool
- BSQL Hacker – Automated SQL Injection Framework

Most Read in Database Hacking:
- Pangolin – Automatic SQL Injection Tool - 64,994 views
- bsqlbf 1.1 – Blind SQL Injection Tool - 53,252 views
- Absinthe Blind SQL Injection Tool/Software - 38,141 views


6 Responses to “MultiInjector – Automated Stealth SQL Injection Tool”

  1. navin 5 November 2008 at 10:40 am Permalink

    whoa…..now i wonder how this can be a good thing!!

  2. Pantagruel 5 November 2008 at 2:32 pm Permalink

    Oh dear, they just made a whole bunch of wannebee SQL crackers happy.

    And indeed is this a good thing??, in a sense it is this allow even the pen-test nitwit to test their sql frontend before releasing it.

  3. navin 6 November 2008 at 10:22 am Permalink

    yeah

    now even skiddies will be able to flex their ‘so-called’ L337 |-|@x0r skills!!

  4. l33t0n3 7 November 2008 at 3:19 pm Permalink

    Traceback (most recent call last):
    File “multiinjector.py”, line 18, in
    import psyco
    ImportError: No module named psyco

    wery thanks i get this :D

  5. Raviv Raz 13 November 2008 at 12:56 am Permalink

    You may download MultiInjector v0.3 at:

    http://chaptersinwebsecurity.blogspot.com/2008/11/multiinjector-v03-released.html

    New features include:

    1) Automatic defacement:
    Try to concatenate a string to all user-defined text fields in DB

    2) Run OS shell command on DB server:
    Run any OS command as if you’re running a command console on the DB machine

    3) Run SQL query on DB server:
    Execute SQL commands of your choice

    4) Enable OS shell procedure on DB:
    Revive the good old XP_CMDSHELL where it was turned off
    (default mode in MSSQL-2005)

    5) Add administrative user to DB server with password: T0pSeKret
    Automagically join the Administrators family on DB machine

    6) Enable remote desktop on DB server:
    Turn remote terminal services back on…

    It’s a more stable and field-tested version.
    Hope you enjoy.

    Peace in the Middle East!
    Raviv Raz

  6. navin 13 November 2008 at 8:27 am Permalink

    thanks for the update Raviv