Kamis, 17 Februari 2011

BSQL Hacker – Automated Sql Injection Tool Video

Sql injection has existed for a long time. This kind of web application vulnerability still exist on many , many web application on the net. Web application developer should have been aware of this web application security threat. There are bunch of sql injection attacks out there performed by some script kiddies out there using a sql injection tool (which is easy to get). In this article , I’d like to introduce you to a tool called BSQL Hacker.

BSQL Hacker
BSQL Hacker
BSQL (Blind SQL) Hacker is an automated SQL Injection Framework / Tool designed to exploit SQL injection vulnerabilities virtually in any database. BSQL Hacker aims for experienced users as well as beginners who want to automate SQL Injections (especially Blind SQL Injections). It allows metasploit alike exploit repository to share and update exploits.
Here are some known features from BSQL Hacker (from Portcullis lab) :
Key Features
* Easy Mode
o SQL Injection Wizard
o Automated Attack Support (database dump)
+ MySQL (experimental)
* General
o Fast and Multithreaded
o 4 Different SQL Injection Support
+ Blind SQL Injection
+ Time Based Blind SQL Injection
+ Deep Blind (based on advanced time delays) SQL Injection
+ Error Based SQL Injection
o Can automate most of the new SQL Injection methods those relies on Blind SQL Injection
o RegEx Signature support
o Console and GUI Support
o Load / Save Support
o Token / Nonce / ViewState etc. Support
o Session Sharing Support
o Advanced Configuration Support
o Automated Attack mode, Automatically extract all database schema and data mode
* Update / Exploit Repository Features
o Metasploit alike but exploit repository support
o Allows to save and share SQL Injection exploits
o Supports auto-update
o Custom GUI support for exploits (cookie input, URL input etc.)
* GUI Features
o Load and Save
o Template and Attack File Support (Users can save sessions and share them. Some sections like username, password or cookie in the templates can be show to the user in a GUI)
o Visually view true and false responses as well as full HTML response, including time and stats
* Connection Related
o Proxy Support (Authenticated Proxy Support)
o NTLM, Basic Auth Support, use default credentials of current user/application
o SSL (also invalid certificates) Support
o Custom Header Support
* Injection Points (only one of them or combination)
o Query String
o Post
o HTTP Headers
o Cookies
* Other
o Post Injection data can be stored in a separated file
o XML Output (not stable)
o CSRF protection support
one time session tokens or asp.net viewstate ort similar can be used for separated login sessions, bypassing proxy pages etc.
It’s still beta and there are known issues :
* Auto-Update doesn’t work (server hasn’t configured yet)
* Exploit Updates doesn’t work (server hasn’t configured yet)
* Automated Attack for MySQL is experimental, might not work properly
Download <=> http://www.ziddu.com/download/13850606/BSQLHackerSetup-0907.exe.html
blogger templates