sqlninja 0.2.1-r1 – SQL Injection Tool for MS-SQL Released for Download

The New Acunetix V12 Engine


Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end. Its main goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered.

It is written in perl and so far has been successfully tested on:

  • Linux
  • FreeBSD
  • Mac OS X

Features

  • Fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability, DB authentication mode)
  • Bruteforce of ‘sa’ password (in 2 flavors: dictionary-based and incremental)
  • Privilege escalation to sysadmin group if ‘sa’ password has been found
  • Creation of a custom xp_cmdshell if the original one has been removed
  • Upload of netcat (or any other executable) using only normal HTTP requests (no FTP/TFTP needed)
  • TCP/UDP portscan from the target SQL Server to the attacking machine, in order to find a port that is allowed by the firewall of the target network and use it for a reverse shell
  • Direct and reverse bindshell, both TCP and UDP
  • DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for a direct/reverse shell, but the DB server can resolve external hostnames (check the documentation for details about how this works)

What’s New

  • A new flavor of bruteforce attack, performed remotely on the target DB Server by using its own CPU resources (use it with caution !)
  • Detection of the authentication mode (mixed or Windows-only), which is useful to understand whether the bruteforce attack to the ‘sa’ account can succeed or not
  • Documentation is now in HTML format, which should make things much easier for new users
  • Several bugfixes and minor improvements

You can download sqlninja 0.2.1-r1 here:

sqlninja 0.2.1-r1

Or read more here.

Posted in: Database Hacking, Hacking Tools

, , , , , , ,


Latest Posts:


testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.
How To Recover When Your Website Got Hacked How To Recover When Your Website Got Hacked
The array of easily available Hacking Tools out there now is astounding, combined with self-propagating malware, people often come to me when their website got hacked and they don't know what to do, or even where to start.
HTTrack - Website Downloader Copier & Site Ripper Download HTTrack – Website Downloader Copier & Site Ripper Download
HTTrack is a free and easy-to-use offline browser utility which acts as a website downloader and a site ripper for copying websites and downloading them for offline viewing.
sshLooter - Script To Steal SSH Passwords sshLooter – Script To Steal SSH Passwords
sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in.


4 Responses to sqlninja 0.2.1-r1 – SQL Injection Tool for MS-SQL Released for Download

  1. CG November 20, 2007 at 3:56 pm #

    we’ve been playing with this tool alot at LSO, its really pretty handy. it was also enumerate the account name if it isnt sa, which is handy, you can then throw passwords at the right username.

    very functional with mssql2000 somewhat less with 2005 but thats the nature of the beast

  2. dirty November 21, 2007 at 1:14 am #

    I havent tested it yet but some colleagues of mine have. Its been out for sometime so I need to get my a$$ in the lab…why is there always so much work around the holidays……ughhhhhh

  3. Goodpeople November 23, 2007 at 7:33 pm #

    Yeah, I wish I had some more time on my hands as well. I always thought that sql-injections are the most fun to play with….

  4. Sir Henry December 14, 2007 at 6:11 pm #

    It appears that we all suffer from the same lack of time to do all the fun things like test these applications.

    @dirty:

    What exactly is your role? Are you a sec eng?