This script uses blind SQL injection and boolean enumeration to perform INFORMATION_SCHEMA Mapping.

Syntax:

perl mysql5enum.pl -h [hostname] -u [url] [-q [query]]

Example:

perl mysql5enum.pl -h www.target.tld -u http://www.target.tld/vuln.ext?input=24 -q “select system_user()”

Description:
– By default, this script will first determine username, version and database name before enumerating the information_schema information.
– When the -q flag is applied, a user can supply any query that returns only a single cell.
– If the exploit or vulnerability requires a single quote, simply tack %27 to the end of the URI.
– This script contains error detection: It will only work on a mysql 5.x database, and knows when its queries have syntax errors.
– This script uses perl’s LibWhisker2 for IDS Evasion (The same as Nikto).
– This script uses the MD5 algorithm for optimization. There are other optimization methods, and this may not work on all sites.

Download: mysql5enum.pl.zip

After a year of hardcore development, sqlmap 0.9 is out!

Introduction:
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.

New Features:

• Rewritten SQL injection detection engine
• Support to directly connect to the database without passing via a SQL injection, -d switch
• Added full support for both time-based blind SQL injection and error-based SQL injection techniques
• Implemented support for SQLite 2 and 3
• Implemented support for Firebird
• Implemented support for Microsoft Access, Sybase and SAP MaxDB
• Added support to tamper injection data with –tamper switch
• Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack
• Added support to fetch unicode data
• Added support to use persistent HTTP(s) connection for speed improvement, –keep-alive switch
• Implemented several optimization switches to speed up the exploitation of SQL injections
• Support to parse and test forms on target url, –forms switch
• Added switches to brute-force tables names and columns names with a dictionary attack, –common-tables and –common-columns.

Demo:

Download: sqlmap-0.9.tar.gz