MultiInjector – Automated Stealth SQL Injection Tool


MultiInjector claims to the first configurable automatic website defacement software, I’m not sure if that’s a good thing – or a bad thing.

But well here it is anyway.

Features

  • Receives a list of URLs as input
  • Recognizes the parameterized URLs from the list
  • Fuzzes all URL parameters to concatenate the desired payload once an injection is successful
  • Automatic defacement – you decide on the defacement content, be it a hidden script, or just pure old “cyber graffiti” fun
  • OS command execution – remote enabling of XP_CMDSHELL on SQL server, subsequently running any arbitrary operating system command lines entered by the user
  • Configurable parallel connections exponentially speed up the attack process – one payload, multiple targets, simultaneous attacks
  • Optional use of an HTTP proxy to mask the origin of the attacks

The author highly recommend running a HTTP sniffer such as IEInspector HTTP Analyzer in order to see all attack requests going out to the targets.

Requirements

  • Python >= 2.4
  • Pycurl (compatible with the above version of Python)
  • Psyco (compatible with the above version of Python)

You can download MultiInjector v0.2 here:

MultiInjector.py

Or read more here.

Posted in: Database Hacking, Hacking Tools, Web Hacking

, , , , ,


Latest Posts:


OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.
trident - Automated Password Spraying Tool trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling
tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.
Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.


6 Responses to MultiInjector – Automated Stealth SQL Injection Tool

  1. navin November 5, 2008 at 10:40 am #

    whoa…..now i wonder how this can be a good thing!!

  2. Pantagruel November 5, 2008 at 2:32 pm #

    Oh dear, they just made a whole bunch of wannebee SQL crackers happy.

    And indeed is this a good thing??, in a sense it is this allow even the pen-test nitwit to test their sql frontend before releasing it.

  3. navin November 6, 2008 at 10:22 am #

    yeah

    now even skiddies will be able to flex their ‘so-called’ L337 |-|@x0r skills!!

  4. l33t0n3 November 7, 2008 at 3:19 pm #

    Traceback (most recent call last):
    File “multiinjector.py”, line 18, in
    import psyco
    ImportError: No module named psyco

    wery thanks i get this :D

  5. Raviv Raz November 13, 2008 at 12:56 am #

    You may download MultiInjector v0.3 at:

    http://chaptersinwebsecurity.blogspot.com/2008/11/multiinjector-v03-released.html

    New features include:

    1) Automatic defacement:
    Try to concatenate a string to all user-defined text fields in DB

    2) Run OS shell command on DB server:
    Run any OS command as if you’re running a command console on the DB machine

    3) Run SQL query on DB server:
    Execute SQL commands of your choice

    4) Enable OS shell procedure on DB:
    Revive the good old XP_CMDSHELL where it was turned off
    (default mode in MSSQL-2005)

    5) Add administrative user to DB server with password: T0pSeKret
    Automagically join the Administrators family on DB machine

    6) Enable remote desktop on DB server:
    Turn remote terminal services back on…

    It’s a more stable and field-tested version.
    Hope you enjoy.

    Peace in the Middle East!
    Raviv Raz

  6. navin November 13, 2008 at 8:27 am #

    thanks for the update Raviv