sqlninja / News: Recent posts

Brand new version of sqlninja !

Fancy going from a SQL Injection to a full GUI access on the DB server? What about extracting password hashes on the fly?
Take a few new SQL Injection tricks, add a couple of remote shots in the registry to disable Data Execution Prevention, mix with a little Perl that automatically generates a debug script, put all this in a shaker with a Metasploit wrapper, shake well and you have the latest release of sqlninja!... read more

Brand new version of sqlninja !

Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end.
Its main goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered.
It is released under the GPLv2 , and it has been featured on SecurityHack's Top 15 Free SQL Injection Scanners and on Hacking Exposed, which is a good result for something that started as a small script written on-the-fly during a pen-test :)... read more

Brand new release of sqlninja!

Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end.
Its main goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered.... read more

sqlninja is a SQL Injection exploitation tool for Microsoft SQL Server 2000 and 2005. Its goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered.
In a nutshell, here's what it does:
- fingerprint of the remote SQL Server (version, user performing the queries, user privileges, xp_cmdshell availability)
- bruteforce of the 'sa' password
- privilege escalation to 'sa'
- creation of a custom xp_cmdshell if the original one has been disabled
- upload of netcat or other executables using only 100% ascii HTTP requests
- reverse scan in order to look for a port that can be used for a reverse shell
- direct and reverse shell, both TCP and UDP
- DNS tunneled pseudoshell, when no ports are available for a bindshell
It is written in perl and runs on Unix. Enjoy !

Sqlninja is a small penetration testing tool for the exploitation of SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server.
Its main goal is to provide a remote shell on the vulnerable DB server, even in a very hostile environment (i.e.: paranoid firewall settings).

This new release provides the ability of tunneling the shell output into DNS requests, bypassing firewalls with paranoid rules.... read more