SQL Power Injector is a graphical application created in .Net 1.1 that helps the penetrating tester to inject SQL commands on a web page.
For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal Mode).
Moreover this application will get all the parameters you need to test the SQL injection, either by GET or POST method, avoiding thus the need to use several applications or a proxy to intercept the data.
Features
- Supported on Windows, Unix and Linux operating systems
- SQL Server, Oracle, MySQL and Sybase/Adaptive Server compliant
- SSL support
-
Load automatically the parameters from a form or a IFrame on a web
page (GET or POST) - Detect and browse the framesets
- Option that auto detects the language of the web site
-
Find automatically the submit page(s) with its method (GET or POST)
displayed in a different color - Single SQL injection
- Blind SQL injection
- Comparison of true and false response of the page or results in
the cookie - Time delay
- Response of the SQL injection in a customized browser
- Fine tuning parameters injection
- Can parameterize the size of the length and count of the expected
result to optimize the time taken by the application to execute the SQL
injection - Multithreading
- Option to replace space by empty comments /**/ against IDS or filter
detection - Automatically encode special characters before sending them
- Automatically detect predefined SQL errors in the response page
- Automatically detect a predefined word or sentence in the response page
- Real time result
- Possibility to inject an authentication cookie
- Can view the HTML code source of the returned page
- Save and load sessions in a XML file
You can find out more here: