Brute Force Database Servers with HexorBase

HexorBase is a database application designed for administering and auditing multiple database servers simultaneously from a centralized location, it is capable of performing SQL queries and bruteforce attacks against common database servers (MySQL, SQLite, Microsoft SQL Server, Oracle, PostgreSQL ).HexorBase allows packet routing through proxies or even metasploit pivoting antics to communicate with remotely inaccessible servers which are hidden within local subnets.

It works on Linux and Windows running the following:

Requirements:

python
python-qt4
cx_Oracle
python-mysqldb
python-psycopg2
python-pymssql
python-qscintilla2

To install simply run the following command in terminal after changing directory to the path were the downloaded package is:

Code:

root@host:~# dpkg -i hexorbase_1.0_all.deb

To get the source code for this project from SVN, here’s the checkout link:

Code:

root@host:~# svn checkout http://hexorbase.googlecode.com/svn/

Heres a video on how the program works

Download:

http://code.google.com/p/hexorbase/

SQL Injection Scanners

Sqlninja ( http://sqlninja.sourceforge.net/ )
Supports only Microsoft SQL Server.

sqlmap ( http://sqlmap.sourceforge.net/ )
Full support: MySQL, Oracle, PostgreSQL and Microsoft SQL Server.
Partial support for: Microsoft Access, DB2, Informix, Sybase and Interbase.

Pangolin 3.2.3 free edition ( http://down3.nosec.org/pangolin_free_edition_3.2.3.1105.zip )
Your web applications using Access,DB2,Informix,Microsoft SQL Server 2000,Microsoft SQL Server 2005,Microsoft SQL Server 2008,MySQL,Oracle,PostgreSQL,Sqlite3,Sybase.
Features: Auto-analyzing keyword, HTTPS support, Pre-Login, Bypass firewall setting, Injection Digger, Data dumper, etc.

Havij v1.14 Advanced SQL Injection – free version (http://www.itsecteam.com/files/havij/Havij1.14Free.rar )

SQL Power Injector ( http://www.sqlpowerinjector.com/ )
Supports: Microsoft SQL Server, Oracle, MySQL, Sybase / Adaptive Server and DB2.

SQLIer 0.8.2b  ( http://bcable.net/releases.php?sqlier )
SQLIer takes an SQL Injection vulnerable URL and attempts to determine all the necessary information to build and exploit an SQL Injection hole by itself, requiring no user interaction at all (unless it can’t guess the table/field names correctly). By doing so, SQLIer can build a UNION SELECT query designed to brute force passwords out of the database. This script also does not use quotes in the exploit to operate, meaning it will work for a wider range of sites.

bsqlbf-v2 ( http://code.google.com/p/bsqlbf-v2/ )
Supports: MySQL, Oracle, PostgreSQL and Microsoft SQL Server.

Marathon Tool ( http://www.codeplex.com/marathontool )
Supports: MySQL, Oracle, Microsoft SQL Server and Microsoft Access.

Absinthe ( http://www.0×90.org/…inthe/index.php )
Supports: Microsoft SQL Server, MSDE, Oracle, and Postgres.

pysqlin ( http://code.google.c…source/checkout )
Implemented: Oracle, MySQL and Microsoft SQL Server.

BSQL Hacker ( http://labs.portcull…on/bsql-hacker/ )
Implemented: Oracle and Microsoft SQL Server.
Available experimental support for MySQL.

SQID ( http://sqid.rubyforge.org/#download)
SQL Injection digger (SQLID) is a command line program that looks for SQL injections and common errors in websites. It can perform the follwing operations: look for SQL injection in a web pages and test submit forms for possible SQL injection vulnerabilities

WITOOL ( http://witool.sourceforge.nSQL, Oracle, Microsoft SQL Server and Microsoft Access.et/ )
Implemented: Oracle and Microsoft SQL Server.

sqlus ( http://sqlsus.sourceforge.net/ )
Supports only MySQL.

DarkMySQLi16.py ( http://vmw4r3.blogspot.com/ )
Supports only MySQL.

mySQLenum ( http://sourceforge.n…ects/mysqlenum/ )
Supports only MySQL.

PRIAMOS ( http://www.priamos-project.com/ )
Supports only Microsoft SQL Server.

FJ-Injector Framework ( http://sourceforge.net/projects/injection-fwk/files/)
FG-Injector is a free open source framework designed to help find SQL injection vulnerabilities in web applications. It includes a proxy feature for intercepting and modifying HTTP requests, and an interface for automating SQL injection exploitation

SFX-SQLi ( http://www.kachakil.com/ )
Supports only Microsoft SQL Server.

DarkMySQL ( http://vmw4r3.blogspot.com/ )
Supports only MySQL.

ProMSiD Premium ( http://forum.web-def…02&postcount=15 )
Supports only MySQL.

Acunetix WVS  ( http://www.acunetix.com/vulnerability-scanner/download.htm)
Automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.

yInjector ( http://y-osirys.com/…-softwares/id10 )
Supports only MySQL.

Bobcat SQL Injection Tool ( http://www.northern-…pub/bobcat.html )

Safe3 Sql Injector ( http://sourceforge.net/projects/safe3si/)
Supports: http, https website, Basic, Digest, NTLM http authentications,GET, Post, Cookie sql injection.
Databases: MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, SQLite, Firebird, Sybase and SAP MaxDB database management systems.
SQL injection techniques: blind, error-based, UNION query and force guess.

ExploitMyUnion ( http://sourceforge.n…exploitmyunion/ )

Laudanum ( http://sourceforge.n…jects/laudanum/ )

Hexjector ( http://sourceforge.n…ects/hexjector/ )

WebRaider ( http://code.google.com/p/webraider/ )
Supports only Microsoft SQL Server.  Designed to execute commands on the server (reverse shell).

Toolza 1.0 ( http://bug-track.ru/prog/toolza1.0.rar )
SQL injection supported DB: Mysql, Mssql, Sybase, Postgresql, Access, Oracle, Firebird / Interbase

SCRT Mini-MySqlat0r (http://www.scrt.ch/attaque/telechargements/mini-mysqlat0r)
A multi-platform application used to audit web sites in order to discover and exploit SQL injection vulnerabilities. It is written in Java and is used through a user-friendly GUI that contains three distinct modules” (Crawler, Tester & Exploiter).

Feel free to propose other SQL Injection Tools