1. SQL Power Injector Avadanei AlinBalan Robert

2. What is SQL Power Injector ?  A graphical application created in C#.Net 1.1 that helps the penetration tester to inject SQL commands on a web page.  Its main strength is its capacity to automate tedious blind SQL injection with several threads.  For now it is SQL Server, Oracle and MySQL compliant, but it is possible to use it with any existing DBMS when using the inline injection (Normal mode).  The normal mode is basically the SQL command that someone will put in the parameter sent to the server.

3. How it works ?  The multithreaded automation of the injection gives the possibility to automate tedious and time consuming queries  The query can be modified to get only what you want.  Moreover this application will get all the parameters you need to test the SQL injection, either by GET or POST method, avoiding thus the need to use several applications or a proxy to intercept the data.  Firefox plugin that will launch SQL Power Injector ?? – No longer available

4. Multithreaded automation  The automation can be realized in two ways:  comparing the expected result  by time delay  The first way is generally compared against an error or difference between positive condition with a negative one.  The second way will turn out positive if the time delay sent to the server equals to the one parameterized in the application.

5. Features  Supported on Windows, Unix and Linux operating systems  SQL Server, Oracle, MySQL, Sybase/Adaptive Server and DB2 compliant  SSL support  Load automatically the parameters from a form or a IFrame on a web page (GET or POST)  Detect and browse the framesets  Option that auto detects the language of the web site  Detect and add cookies used during the Load Page process (Set-Cookie detection)

6. Features  Find automatically the submit page(s) with its method (GET or POST) displayed in a different color  Can create/modify/delete loaded string and cookies parameters directly in the Datagrids  Single SQL injection  Blind SQL injection  Comparison of true and false response of the page or results in the cookie  Time delay  Response of the SQL injection in a customized browser  Multithreading (configurable up to 50)

7. Demo

8. Differences with Other Tools  Web page string and cookie parameters auto detection  Fine tuning parameters SQL injection  Time delay feature  Multithread feature  Response results in a customized browser  Automated positive and negative condition discovery  Blind SQL injection characters preset optimizer

9. Conclusion  In closing, SQL injection enables you to inject malicious code into strings that are destined for storage in a table or as metadata and test your webpages and databases for security vulnerabilities