MultiInjector – Automated Stealth SQL Injection Tool


MultiInjector claims to the first configurable automatic website defacement software, I’m not sure if that’s a good thing – or a bad thing.

But well here it is anyway.

Features

  • Receives a list of URLs as input
  • Recognizes the parameterized URLs from the list
  • Fuzzes all URL parameters to concatenate the desired payload once an injection is successful
  • Automatic defacement – you decide on the defacement content, be it a hidden script, or just pure old “cyber graffiti” fun
  • OS command execution – remote enabling of XP_CMDSHELL on SQL server, subsequently running any arbitrary operating system command lines entered by the user
  • Configurable parallel connections exponentially speed up the attack process – one payload, multiple targets, simultaneous attacks
  • Optional use of an HTTP proxy to mask the origin of the attacks

The author highly recommend running a HTTP sniffer such as IEInspector HTTP Analyzer in order to see all attack requests going out to the targets.

Requirements

  • Python >= 2.4
  • Pycurl (compatible with the above version of Python)
  • Psyco (compatible with the above version of Python)

You can download MultiInjector v0.2 here:

MultiInjector.py

Or read more here.

Posted in: Database Hacking, Hacking Tools, Web Hacking

, , , , ,


Latest Posts:


SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.
DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.


6 Responses to MultiInjector – Automated Stealth SQL Injection Tool

  1. navin November 5, 2008 at 10:40 am #

    whoa…..now i wonder how this can be a good thing!!

  2. Pantagruel November 5, 2008 at 2:32 pm #

    Oh dear, they just made a whole bunch of wannebee SQL crackers happy.

    And indeed is this a good thing??, in a sense it is this allow even the pen-test nitwit to test their sql frontend before releasing it.

  3. navin November 6, 2008 at 10:22 am #

    yeah

    now even skiddies will be able to flex their ‘so-called’ L337 |-|@x0r skills!!

  4. l33t0n3 November 7, 2008 at 3:19 pm #

    Traceback (most recent call last):
    File “multiinjector.py”, line 18, in
    import psyco
    ImportError: No module named psyco

    wery thanks i get this :D

  5. Raviv Raz November 13, 2008 at 12:56 am #

    You may download MultiInjector v0.3 at:

    http://chaptersinwebsecurity.blogspot.com/2008/11/multiinjector-v03-released.html

    New features include:

    1) Automatic defacement:
    Try to concatenate a string to all user-defined text fields in DB

    2) Run OS shell command on DB server:
    Run any OS command as if you’re running a command console on the DB machine

    3) Run SQL query on DB server:
    Execute SQL commands of your choice

    4) Enable OS shell procedure on DB:
    Revive the good old XP_CMDSHELL where it was turned off
    (default mode in MSSQL-2005)

    5) Add administrative user to DB server with password: T0pSeKret
    Automagically join the Administrators family on DB machine

    6) Enable remote desktop on DB server:
    Turn remote terminal services back on…

    It’s a more stable and field-tested version.
    Hope you enjoy.

    Peace in the Middle East!
    Raviv Raz

  6. navin November 13, 2008 at 8:27 am #

    thanks for the update Raviv