SQL Power Injector is a graphical application created in .Net 1.1 that helps the penetrating tester to inject SQL commands on a web page.

For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal Mode).

Moreover this application will get all the parameters you need to test the SQL injection, either by GET or POST method, avoiding thus the need to use several applications or a proxy to intercept the data.

Features

• Supported on Windows, Unix and Linux operating systems
• SQL Server, Oracle, MySQL and Sybase/Adaptive Server compliant
• SSL support
• Load automatically the parameters from a form or a IFrame on a web
  page (GET or POST)
• Detect and browse the framesets
• Option that auto detects the language of the web site
• Find automatically the submit page(s) with its method (GET or POST)
  displayed in a different color
• Single SQL injection
• Blind SQL injection
• Comparison of true and false response of the page or results in
  the cookie
• Time delay
• Response of the SQL injection in a customized browser
• Fine tuning parameters injection
• Can parameterize the size of the length and count of the expected
  result to optimize the time taken by the application to execute the SQL
  injection
• Multithreading
• Option to replace space by empty comments /**/ against IDS or filter
  detection
• Automatically encode special characters before sending them
• Automatically detect predefined SQL errors in the response page
• Automatically detect a predefined word or sentence in the response page
• Real time result
• Possibility to inject an authentication cookie
• Can view the HTML code source of the returned page
• Save and load sessions in a XML file

You can find out more here:

SQL Power Injector

Download the latest version now.

Windows Rootkits are a big rarity in this modern web hacking tehnology…
I won’t speak exactly about rootkits, because it’s impropriate to call them that way… why? Well rootkits are programs that aid you in getting access to root level users…

So in the case we are using Windows rootkits we should call them admkits (admin kits [©copyrighted to me of course])…. So let’s cut the **** and get down to serious business.

Note: the following admkits are from www.packetstormsecurity.org, there also could be others available on the net… not just the following 4

_ROOT_040

Windows NT Rootkit v0.04 alpha – Hides processes, files, directories, has k-mode shell using TCP/IP – you can telnet into rootkit from remote. Hides registry keys – (keyboard patch disabled in this build.) Includes execution redirection.

Fake Netstat

Fake Netstat is a windows copy of netstat which can hide certain network connections. Requires renaming the original netstat.

NT BindShell

Ntbindshell is a lightweight (24k compiled) cmd.exe backdoor for Windows. Full C source included. Provides two modes of operation – standard (listening mode) or reverse-connect mode. Includes the ability to install itself as a system service, providing a shell with LocalSystem privileges.

reverseTelnet

Reverse telnet redirector / port redirector and front end console for Windows. Perfect for firewall bypassing from inside out. Can be used for bouncing connections, piping or relaying data, or as a quick MIM chat server. Windows executable form only.

More information of course can be found in the readme files from the archive…