sqlget v1.0.0 – Blind SQL Injection Tool in PERL


sqlget is a blind SQL injection tool developed in Perl, it lets you get databases schemas and tables rows. Using a single GET/POST you can access quietly the database structure and using a single GET/POST you can dump every table row to a csv-like file.

Databases supported:

  • IBM DB2
  • Microsoft SQL Server
  • Oracle
  • Postgres
  • Mysql
  • IBM Informix
  • Sybase
  • Hsqldb
  • Mime
  • Pervasive
  • Virtuoso
  • SQLite
  • Interbase/Yaffil/Firebird (Borland)
  • H2
  • Mckoi
  • Ingres
  • MonetDB
  • MaxDB
  • ThinkSQL
  • SQLBase

Evasion features:

  • Full-width/Half-width Unicode encoding
  • Apache non standard CR bypass
  • mod_security bypass
  • Random uppercase request transform
  • PHP Magicquotes: encode every string using db CHR function or similar.
  • Convert requests to hexadecimal values
  • Avoid non-space replacing for /**/ or (\t) tab
  • Avoid non || or + concatenation using db concat function or similar.
  • Random user-agent
  • Random proxy-server
  • Random delay request

Common features:

  • Database schemate download blacklist
  • Cookie array support
  • SSL support
  • Proxy server support
  • Database information dumped in csv format

You can find a demo here bypassing IBM ISS Proventia IPS:


ISR sqlget ISS Proventia Bypass

And you can download sqlget here:

ISR-sqlget v.1.0.0

Or read more here.

Posted in: Database Hacking, Hacking Tools, Web Hacking

, , , , , ,


Latest Posts:


ZigDiggity - ZigBee Hacking Toolkit ZigDiggity – ZigBee Hacking Toolkit
ZigDiggity a ZigBee Hacking Toolkit is a Python-based IoT (Internet of Things) penetration testing framework targeting the ZigBee smart home protocol.
RandIP - Network Mapper To Find Servers RandIP – Network Mapper To Find Servers
RandIP is a nim-based network mapper application that generates random IP addresses and uses sockets to test whether the connection is valid or not with additional tests for Telnet and SSH.
Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.


8 Responses to sqlget v1.0.0 – Blind SQL Injection Tool in PERL

  1. gyaresu July 9, 2007 at 6:31 am #

    Lovely. Another fine toy to play with.

    Thanks Chap(s/ettes).

  2. Darknet July 9, 2007 at 7:40 am #

    Yah I like the evasion features of this one, you can really tell it’s written by a pen-tester :)

    No chapettes here tho heh.

  3. gyaresu July 9, 2007 at 7:48 am #

    No chapettes here tho heh.

    One must not assume.

    Again the flash example is quite instructive. Great for just jumping in and having a bash. The README contains plenty of info also.

    The flash player it’s running in is also good. Not having a complete mental when you drag it fore & back in time. Some of them are rubbish.

  4. backbone July 9, 2007 at 1:16 pm #

    well it sounds promising, I’ll have to try it out….

  5. SN July 9, 2007 at 8:00 pm #

    I am going to check this out. Let’s see if it crashes my site.

  6. Sandeep Nain July 9, 2007 at 11:52 pm #

    seems to be a good tool with such a long list of supported databases. ill check this one out..

  7. Sandeep Nain July 31, 2007 at 11:41 pm #

    Hi Guys

    anybody tried this out? I did but sorry to say that I didnt find it much impressive. although it offers a great database support and some nice features such as proxy server supoort and ssl support.

    But i found OWASP sqlix better than this. better results…

    let me know if your opinion differs from me…

  8. backbone August 1, 2007 at 3:36 am #

    I didn’t even succeed with the compilation of it :-\