Keep Your Database Free from SQL Injection Attacks

SQL injection attacks have become a hot topic again, following Computerworld's report that Oracle.comsuffered such an attack this week. This kind of attack, one of the most well-known and dangerous but least understood, was used to breach the security of Oracle's customer website, exposing usernames and, in some cases, passwords.

To protect your databases, check out our excerpt from Justin Clarke's "SQL Injection Attacks and Defense." The excerpt explains in detail exactly what an SQL injection is and how it works so you can take appropriate steps to minimize vulnerability.

You should also take a look on our password creation and management resources, since these "stolen passwords" lists often expose users' lackadaisical attitudes towards creating hard-to-break passwords. These sample policies and policy templates can make sure that weak passwords don't compromise data security:

SQL Injection Vulnerability In Google Lab Database System found by Shadman Tanjim

SQL Injection Vulnerability In Google Lab Database System found by Shadman Tanjim (Admin Bangladesh Cyber Army). Here is the report Submitted By Shadman to VOGH. 

REPORT:-

Very Big and Critical Vulnerability detect in Google Lab System. Vendor is already reported. But they don’t take positive step in this case this vulnerability is now exposed and open in public. Now I tell details About the Vulnerability in Google Lab System.
Google Lab Website has SQL Injection Vulnerability and Dangerous thing is this
Vulnerability is Exploitable. We can get Tables, columns and data. Google Lab
Database has his own customize DB system. But Interesting things is their database system is Similar as Ms Access database. In this case Ms Access SQL Injection System is Also Work on Google Lab Database system. And this vulnerability is 100% real and Now We can see this in our eyes. 

Now I give you Step by step proof about this Vulnerability.

1. Website: www.googlelabs.com or labs.google.com

2. Vulnerability type: SQL Injection

3. Vulnerable url: http://www.googlelabs.com/?q=%27&apps=Search+Labs

4. Injection Area in Link:
http://www.googlelabs.com/?q=%27&apps=%Inject_Here%Search+Labs 

Info:

6. Host IP: 209.85.175.141
7. Web Server: Google Frontend
8. Keyword Found: Fast
9. Injection type is Integer
10. Keyword corrected: Swirl

Let’s Check Exploiting this Vulnerable link. Here I use 3 Famous SQL Injection
tools. They are:

1. Havij Advance SQL Injection Tool

Website: http://itsecteam.com/en/projects/project1.htm

2. Safe3 SQL Injector v8.4

Website: http://www.safe3.com.cn/en/safe3si.htm

3. Pangolin SQL Injection Tool

Website: http://www.nosec-inc.com/en/

You Can Download the Video Of This Vulnerability VIDEO LINK

To Download the Full PDF report Click HERE

SQLol -SQL-i Vulnerability Testing Framework

In the Austin Hackers Association meeting they released SQLol. SQLolis a configurable SQL injection testbed. It allows you to exploit SQL injection flaws, but furthermore allows a large amount of control over the manifestation of the flaw. The author thought about different data extraction techniques from SQL injection flaws and found that a vulnerability framework that includes SQLi verbose error extraction techniques was never found. To be precise, the author never came across a vulnerability framework that includes SQL injection in a DELETE query. So, with this aim in mind, SQLol was born, specifically for SQL injection flaws. It can be useful to those who know nothing about SQL injection, or those who know a bit of it. SQLol comes with a set of challenges which help you with performing some flavor of SQL injection and have pre-configured settings.

Options:-

• Type of query
• Location within query
• Type and level of sanitization
• Level of query output
• Verbosity of error messages
• Visibility of query
• Injection string entry point

Other Cool Things:-

• Reset button
• Challenges
• Support for multiple database systems

Requirements:-

• PHP 5.x
• Web server
• Database server (MySQL, PostgreSQL and SQLite have been tested, others may work)
• ADODB library (included)

To Download SQLol Click Here

NTO SQL Invader: A SQL Injection Tool

NTO SQL Invader gives the ability to quickly and easily exploit or demonstrate SQL Injection vulnerabilities in Web applications. With a few simple clicks, we will be able to exploit a vulnerability to view the list of records, tables and user accounts of the back-end database.

Features:-

• Easy to use – The tool’s GUI interface enables you to simply paste the injectable request found by a DAST tool or feed a detailed request straignt from an application scan report. You can then control how much information is harvested.
• Clearly presents evidence – Unlike tools that provide all data via command line, NTO SQL Invader provides the data in a organized manner that is useful for both executive meetings as well as technical analysis and remediation.
• Enables easy transport of logging data – All of the data harvested from NTO SQL Invader can be saved into a CSV file so the reports can be included as penetration evidence as part of a presentation or POC.

To Download NTO SQL Invader Click Here

Havij v1.16 Advanced & Automated SQL Injection Tool Released

One of the most preferred and widely used SQL-injector Havij has released another updated version (v1.16). In the middle of last year ITSec team made Havij 1.15 available, so after one year of hard work now we got the next edition of this marvellous SQL-i tool. As per survey Havij is listed as one of the finest and widely used tool used for finding SQL Injection vulnerabilities on a web page. It has been thoroughly used by hackers along with penetration testers over the whole spectrum. 

Brief About Havij :- It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and  password hashes, dump tables and columns, fetching data from the database, running SQL  statements and even accessing the underlying file system and executing commands on the  operating system. The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij. The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.

New Features :-

• Multithreading

• Oracle Blind injection method.

• Automatic all parameter scan added.

• New blind injection method (no more ? char.)

• Retry for blind injection.

• A new method for tables/columns extraction in mssql blind.

• A WAF bypass method for mysql blind.

• Getting tables and columns even when can not get current database.

• Auto save log.

Bug Fixed:- 

• url encode bug fixed.

• Trying time based methods when mssql error based and union based fail.

• Clicking get columns would delete all tables.

• Reseting time based method delay when applying settings.

• Oracle and PostgreSQL detection
• For additional information & to Download Havij v1.16 Click Here