VIRTUAL BANK,TOOL HACKING,PAYPAL

<h1>
News</h1>
There is a shiny new data extraction method in the alpha of the new 
release. It uses WAITFOR-based injection (slow) and DNS tunnels 
(fast!!). 
It is still extremely experimental, so don't expect it to be very stable
 yet. 
However, it might be already stable enough to help you in your next 
penetration test. 
You can find it in the <a href="http://sqlninja.sourceforge.net/download.html">Download</a>. 
Why we decided to add a data extraction module even if lots of other tools do that already? The answer is in the <a href="http://sqlninja.sourceforge.net/faq.html">FAQ page</a>.
<br />

<h1>
Introduction</h1>
Fancy going from a SQL Injection on Microsoft SQL Server to a full GUI 
access on
 the DB? Take a few new SQL Injection tricks, add a couple of remote 
shots in the registry to disable Data Execution Prevention, mix with a 
little Perl that automatically generates a debug script, put all this in
 a shaker with a Metasploit 
wrapper, shake well and you have just one of the attack modules of 
sqlninja!<br />
Sqlninja is a tool targeted to exploit SQL Injection vulnerabilities
on a web application that uses Microsoft SQL Server as its back-end.<br />
Its main goal is to provide a remote access on the vulnerable DB server,
even in a very hostile environment. It should be used by penetration
testers to help and automate the process of taking over a DB Server
when a SQL Injection vulnerability has been discovered.<br />
Plus, it also streams music!! (...kudos to <a href="https://twitter.com/#%21/_sid77" target="_new">sid77</a> and <a href="https://twitter.com/#%21/shootingsawk" target="_new">smiler</a> for
being the first to spot the Easter Egg)<br /><br />
Have a look at the <a href="http://sqlninja.sourceforge.net/sqlninjademo.html">flash demo</a> and then feel free
 to <a href="http://sqlninja.sourceforge.net/download.html">download</a>. 
It is released under the <a href="http://www.gnu.org/licenses/gpl.html" target="_blank">GPLv3</a><br />
<br />

<h1>
Screenshots<br />
</h1>
<div id="sliderFrame">
        <div id="slider" style="background: url("images/sqlninja-3.png") no-repeat scroll 0% 0% transparent;">
            
            
            
            
            
        <div class="mc-caption-bg2" style="opacity: 0.1; visibility: visible;">
<div class="mc-caption" style="width: 700px;">
enumerating table data</div>
</div>
</div>
</div>

<h1>
Features<br />
</h1>
The full documentation can be found in the tarball and also <a href="http://sqlninja.sourceforge.net/sqlninja-howto.html" target="_blank">here</a>, but here's a list of what the Ninja does:<br />
<br />

<ul>
<li>Fingerprint of the remote SQL Server (version, user performing the
 queries, user privileges, xp_cmdshell availability, DB authentication 
mode)</li>
<li>Data extraction, time-based or via a DNS tunnel</li>
<li>Integration with Metasploit3, to obtain a graphical access to the 
remote DB server through a VNC server injection or just to upload 
Meterpreter</li>
<li>Upload of executables using only normal HTTP requests (no FTP/TFTP needed), via vbscript or debug.exe</li>
<li>Direct and reverse bindshell, both TCP and UDP</li>
<li>DNS-tunneled pseudo-shell, when no TCP/UDP ports are available for
 a direct/reverse shell, but the DB server can resolve external 
hostnames</li>
<li>ICMP-tunneled shell, when no TCP/UDP ports are available for a direct/reverse shell but the DB can ping your box</li>
<li>Bruteforce of 'sa' password (in 2 flavors: dictionary-based and incremental)</li>
<li>Privilege escalation to sysadmin group if 'sa' password has been found</li>
<li>Creation of a custom xp_cmdshell if the original one has been removed</li>
<li>TCP/UDP portscan from the target SQL Server to the attacking 
machine, in order to find a port that is allowed by the firewall of the 
target network and use it for a reverse shell</li>
<li>Evasion techniques to confuse a few IDS/IPS/WAF</li>
<li>Integration with churrasco.exe, to escalate privileges to SYSTEM on w2k3 via token kidnapping</li>
<li>Support for CVE-2010-0232, to escalate the privileges of sqlservr.exe to SYSTEM</li>
</ul>
<h1>
Platforms supported</h1>
Sqlninja is written in Perl and should run
on any UNIX based platform with a Perl interpreter, as long as all
needed modules have been installed. So far it has been successfully
tested on:<br />
<br />

<ul>
<li>Linux</li>
<li>FreeBSD</li>
<li>Mac OS X</li>
<li>iOS</li>
</ul>
Sqlninja does not run on Windows and we are not planning a port in the near future

News There is a shiny new data extraction method in the alpha of the new release. It uses WAITFOR-based injection (slow) and DNS tunnels ...

SQL Server injection & takeover tool