SQL Injection Tools

[Serg B]

Hi All,

Can anybody suggest a relatively reliable SQL injection tool?  Either
Open Source or proprietary - required for business use.  So far, I've
been clobbering all sorts of weird SQL strings manually, would be nice
to minimize the repetitive keyboard labor.

So far, I am going through this list:
http://www.security-hacks.com/2007/05/18/top-15-free-sql-injection-scanners

If there is anything better out there, or if anybody thinks I should
concentrate on a particular tool from the list (link above), please
let me know.


Thanks,
   Serg

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[oh oh]

Thanks for your list

I'm looking for the sql injection tool for testing in my lab.
If possible , I'll report some result in every tool in your list when
i finnish the test.
For business use , I used to take sql ninja for test my client.


On 6/23/08, Serg B <sergeslists@...> wrote:

> Hi All,
>
> Can anybody suggest a relatively reliable SQL injection tool?  Either
> Open Source or proprietary - required for business use.  So far, I've
> been clobbering all sorts of weird SQL strings manually, would be nice
> to minimize the repetitive keyboard labor.
>
> So far, I am going through this list:
> http://www.security-hacks.com/2007/05/18/top-15-free-sql-injection-scanners
>
> If there is anything better out there, or if anybody thinks I should
> concentrate on a particular tool from the list (link above), please
> let me know.
>
>
> Thanks,
>    Serg
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web
> application security assessments should be considered a crucial phase in the
> development of any web application. What methodology should be followed?
> What tools can accelerate the assessment process? Download this Whitepaper
> today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

--
Chadchawan Tapin
Semi-Senior, IT Advisory, Security Team
Some Company in Thailand

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Rick Zhong]

Hi,
I guess it is kind of difficult to find an almighty all-purpose sql
injection tool, simply because the vast varieties of SQL injection
attacks due to different databases, techniques and progamming language
APIs. You may want to go for more specialized classifications, for
example, absinthe and SQL Power Injector are good in blind SQL
injection testing while SQLninja and NBSI are good for ASP+MSSQL
applications. NGSS is very well-known for their Oracle vulnerability
research capabilities.

I have used/evaluated about half of those tools in that list, and SQL
Power Injector is most impressive to me. It might has a sharp learning
curve initially due to all the configuration and tuning, but it is
well-documented.

regards,
Rick Zhong
------------------------------------------------------------------------------------------------
Welcome to my blog - Informaiton (In)Security in Financial Industry
http://blog.rickzhong.com
------------------------------------------------------------------------------------------------



On Mon, Jun 23, 2008 at 8:23 AM, Serg B <sergeslists@...> wrote:

> Hi All,
>
> Can anybody suggest a relatively reliable SQL injection tool?  Either
> Open Source or proprietary - required for business use.  So far, I've
> been clobbering all sorts of weird SQL strings manually, would be nice
> to minimize the repetitive keyboard labor.
>
> So far, I am going through this list:
> http://www.security-hacks.com/2007/05/18/top-15-free-sql-injection-scanners
>
> If there is anything better out there, or if anybody thinks I should
> concentrate on a particular tool from the list (link above), please
> let me know.
>
>
> Thanks,
>   Serg
>
> -------------------------------------------------------------------------
> Sponsored by: Watchfire
> Methodologies & Tools for Web Application Security Assessment
> With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!
>
> https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
> -------------------------------------------------------------------------
>
>

--
Information (In)Security In Financial Industry: h44p://blog.rickzhong.com

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------

[Jason Ross]

On Sun, Jun 22, 2008 at 8:23 PM, Serg B <sergeslists@...> wrote:
> Hi All,
>
> Can anybody suggest a relatively reliable SQL injection tool?  Either
> Open Source or proprietary - required for business use.  So far, I've
> been clobbering all sorts of weird SQL strings manually, would be nice
> to minimize the repetitive keyboard labor.


You don't mention what DBMS is on the backend, which may make a
difference in the choice of tools.
In general however, I find Absinthe rocks, and it offers some very
nice features for business use (eg. the ability to place a custom
string in every transaction, useful to verify whether the database
dying in the middle of your testing was related to something you did
or not... etc.)

--
jason

-------------------------------------------------------------------------
Sponsored by: Watchfire
Methodologies & Tools for Web Application Security Assessment
With the rapid rise in the number and types of security threats, web application security assessments should be considered a crucial phase in the development of any web application. What methodology should be followed? What tools can accelerate the assessment process? Download this Whitepaper today!

https://www.watchfire.com/securearea/whitepapers.aspx?id=70170000000940F
-------------------------------------------------------------------------