Tuesday, September 19, 2006

SQL Power Injector v1.1

SQL Power Injector is a graphical application created in .Net 1.1 that helps the penetrating tester to inject SQL commands on a web page.
For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal Mode).
Moreover this application will get all the parameters you need to test the SQL injection, either by GET or POST method, avoiding thus the need to use several applications or a proxy to intercept the data.

Features:

  • Supported on Windows, Unix and Linux operating systems
    SQL Server, Oracle, MySQL and Sybase/Adaptive Server compliant
    SSL support
    Load automatically the parameters from a form or a IFrame on a webpage (GET or POST)
    Detect and browse the framesets
    Option that auto detects the language of the web site
    Find automatically the submit page(s) with its method (GET or POST)displayed in a different color
    Single SQL injection
    Blind SQL injection
    Comparison of true and false response of the page or results inthe cookie
    Time delay
    Response of the SQL injection in a customized browser
    Fine tuning parameters injection
    Can parameterize the size of the length and count of the expectedresult to optimize the time taken by the application to execute the SQLinjection
    Multithreading
    Option to replace space by empty comments /**/ against IDS or filterdetection
    Automatically encode special characters before sending them
    Automatically detect predefined SQL errors in the response page
    Automatically detect a predefined word or sentence in the response page
    Real time result
    Possibility to inject an authentication cookie
    Can view the HTML code source of the returned page
    Save and load sessions in a XML file
You can find out more here:
SQL Power Injector
Download the latest version now.

No comments: