sqlsus is an open source MySQL injection and takeover tool, written in perl.
Via a command line interface, you can retrieve the database(s) structure, inject your own SQL queries (even complex ones), download files from the web server, crawl the website for writable directories, upload and control a backdoor, clone the database(s), and much more...
Whenever relevant, sqlsus will mimic a MySQL console output.
sqlsus focuses on speed and efficiency, optimising the available injection space, making the best use (I can think of) of MySQL functions.
It uses stacked subqueries and an powerful blind injection algorithm to maximise the data gathered per web server hit.
Using multithreading on top of that, sqlsus is an extremely fast database dumper, be it for inband or blind injection.
If the privileges are high enough, sqlsus will be a great help for uploading a backdoor through the injection point, and takeover the web server.
It uses SQLite as a backend, for an easier use of what has been dumped, and integrates a lot of usual features (see below) such as cookie support, socks/http proxying, https..
FEATURES
GENERAL
Both quoted and numeric injections are supported.
Databases names, tables names, columns names, count(*) per table, privileges... On MySQL > 5, the database structure can be grabbed in one command from within sqlsus.
Discovery of the exact injection space, going through all possible restrictions (web server, suhosin patch...), to inject as much as possible at once.
All quoted texts can be translated as their hex equivalent to bypass any quotes filtering (eg: magic_quotes_gpc) (eg : "sqlsus" will become 0x73716c737573).
sqlsus also supports these types of injection :
- inband (UNION w/ stacked subqueries) : the result of the request will be in the HTML returned by the web server
- blind (boolean-based or time-based) : when you can't see the result of the request directly
Support for GET and POST parameters injection vectors.
Support for HTTP proxy and HTTP simple authentication.
Support for HTTPS.
Support for socks proxy.
Support for cookies.
Support for binary data retrieving.
Full SQLite backend, storing queries / results as they come, databases structure, key variables. This allows you to recall a command and its cached answer, even in a later re-use of the session.
Possibility to clone a database / table / column, into a local SQLite database, and continue over different sessions.
If you can't access the information_schema database, or if it doesn't exist, sqlsus will help you bruteforce the names of the tables and columns.
Possibility to change the current database and still use all the commands transparently.
Auto-detection of the length restriction in place, be it the web server or the layer above (eg: suhosin).
INBAND
If your query is likely to return more than one row, sqlsus will use as many subqueries it can use at a time (per query), staying under a configurable limit.
Therefore, it can grab up to thousands of records in just 1 server hit (depending on the available injection space) (cf inband demo)
Once you have found an inband injection, you need to find the correct number of columns for UNION. sqlsus will do the job for you, identifying the needed number of columns, and which of them are suitable for injection.
To speed things up, multithreading (actually, multiple processes (fork)) can be used.
BLIND
Blind injection is supported, using conditional responses, and multithreading (actually, again, multiple processes (fork)).
The engine has been optimised in speed and server hit :
- keep all the threads busy with small relevant tasks.
- match each item against a few regular expressions, prior to bruteforcing, to determine the character space to use, reducing a lot the number of hits required.
TAKEOVER
If the database user has the FILE privilege, and if you can use quotes in your injection (mandatory for a SELECT INTO OUTFILE), then sqlsus will help you place a php backdoor on the remote system, recursively looking for writable directories.
You can use download <file> from sqlsus shell, to download an arbitrary (world readable) file from the remote server. The file will be stored in the local filesystem, rebuilding the path tree to the file in the datadirectory.
sqlsus has the ability to crawl the website at a configurable depth, looking for all the directories it can find, via hypertext links, img links, etc... Then, it tries to upload a tiny php uploader on each candidate directory until it finds one world writable, later used to upload the backdoor itself.
All sqlsus needs (besides what has been said above) is the document_root used server side. You can find it by downloading/reading the relevant files on the web server.
It ships with a PHP backdoor you can upload and a controller, to help you execute system commands, PHP commands, and SQL queries as if you were sitting on a normal direct MySQL connection.
GETTING STARTED
Generate a configuration file with sqlsus --genconf my.cfg, read the comments and adapt it to reflect your target.
Launch sqlsus, with your configuration as a parameter sqlsus my.cfg, you will get a shell.
Type help and follow your instincts :)
Sources:
Every weekend i used to go to see this web page, as i wish for enjoyment,
ReplyDeleteas this this web site conations truly pleasant funny material too.
My webpage ... direct payday loan lenders
151202meiqing
ReplyDeletemichaek kors handbags
nike trainers
chanel bags
north face jackets
pandora jewelry
michael kors outlet clearance
louis vuitton bags
lebron james shoes
ralph lauren outlet
nike huarache
jordan 11
cheap jordans
lebron james shoes 2015
cheap uggs
ugg boots
canada goose
ugg australia
michael kors outlet
ugg slippers
replica watches
uggs for sale
ugg boots for men
toms shoes
coach outlet online
cheap oakley sunglasses
louis vuitton outlet
michael kors outlet online
uggs australia
ugg boots
oakley sunglasses
michael kors outlet
ray ban sunglasses
uggs on sale
canada goose outlet
christian louboutin
uggs outlet
nike air max
coach factory outlet
ed hardy clothing
cheap jordans
oakley sunglasses wholesale
ReplyDeleteray ban outlet
cheap ray ban sunglasses
ray ban outlet
coach outlet store
coach outlet online
louis vuitton handbags
louis vuitton outlet online
louis vuitton outlet store
louis vuitton handbags outlet
louis vuitton bags
michael kors handbags
michael kors outlet online
michael kors outlet
michael kors outlet
michael kors outlet
prada outlet online
tory burch outlet online
timberland shoes
1224minko
ugg outlet uk
ReplyDeleteugg outlet online
ugg boots sale
ugg boots
discount ugg boots
cheap ugg boots
michael kors factory store
canada goose coats
canada goose outlet
canada goose outlet
canada goose jackets
chanel handbags outlet
lululemon pants
phone cases
north face jackets
cheap jordan shoes
air jordan shoes for sale
marc jacobs
ferragamo outlet
ninest123 16.03
ReplyDeletechristian louboutin, tory burch outlet, ray ban sunglasses, nike outlet, ralph lauren outlet, louboutin shoes, louis vuitton handbags, replica watches, louis vuitton, louis vuitton outlet, ralph lauren polo, replica watches, michael kors outlet, christian louboutin, longchamp bags, nike air max, cheap oakley sunglasses, oakley sunglasses, uggs outlet, oakley sunglasses, cheap jordans, michael kors outlet online, tiffany jewelry, burberry outlet, prada outlet, louis vuitton outlet, longchamp outlet, uggs on sale, prada handbags, louis vuitton outlet online, michael kors handbags, uggs on sale, uggs outlet, tiffany jewelry, louboutin uk, michael kors outlet online, michael kors outlet online, oakley sunglasses, michael kors, longchamp outlet, nike air max, gucci handbags, ray ban sunglasses, uggs on sale, oakley sunglasses, burberry factory outlet, ray ban sunglasses, nike free
links of london uk, ugg,ugg australia,ugg italia, karen millen uk, louis vuitton, hollister, coach outlet, moncler, sac louis vuitton, montre pas cher, gucci, canada goose outlet, barbour, pandora jewelry, louis vuitton, sac louis vuitton, canada goose pas cher, toms shoes, ugg uk, moncler uk, supra shoes, wedding dresses uk, barbour jackets uk, pandora jewelry, moncler, bottes ugg pas cher, canada goose, canada goose jackets, juicy couture outlet, pandora uk, juicy couture outlet, canada goose uk, marc jacobs, canada goose jackets, louis vuitton uk, moncler outlet, pandora charms, swarovski uk, replica watches, lancel, canada goose outlet, moncler pas cher, moncler, thomas sabo uk, swarovski jewelry, moncler, ugg pas cher, canada goose, converse shoes outlet, moncler jackets, ugg,uggs,uggs canada, ray ban
ReplyDeleteninest123 16.03