SQL Power Injector is a graphical application created in .Net 1.1 that helps the penetrating tester to inject SQL commands on a web page.
For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal Mode).
Moreover this application will get all the parameters you need to test the SQL injection, either by GET or POST method, avoiding thus the need to use several applications or a proxy to intercept the data.
Features:
- Supported on Windows, Unix and Linux operating systems
SQL Server, Oracle, MySQL and Sybase/Adaptive Server compliant
SSL support
Load automatically the parameters from a form or a IFrame on a webpage (GET or POST)
Detect and browse the framesets
Option that auto detects the language of the web site
Find automatically the submit page(s) with its method (GET or POST)displayed in a different color
Single SQL injection
Blind SQL injection
Comparison of true and false response of the page or results inthe cookie
Time delay
Response of the SQL injection in a customized browser
Fine tuning parameters injection
Can parameterize the size of the length and count of the expectedresult to optimize the time taken by the application to execute the SQLinjection
Multithreading
Option to replace space by empty comments /**/ against IDS or filterdetection
Automatically encode special characters before sending them
Automatically detect predefined SQL errors in the response page
Automatically detect a predefined word or sentence in the response page
Real time result
Possibility to inject an authentication cookie
Can view the HTML code source of the returned page
Save and load sessions in a XML file
SQL Power Injector
Download the latest version now.
No comments:
Post a Comment