首页 > 技术文章 > Automatic Web Site Defacement

Automatic Web Site Defacement

2008年10月13日 发表评论 97 views 阅读评论

Author: chaptersinwebsecurity
 

Hi all,
I'm new to posting content on this mailing list, but thought some of you
would be interested in an automatic SQL parameter injector
able to test for automatic database / web site defacement and / or OS
command execution given a list of URLs from a text file.
You may find more detailed explanation about this tool and a download link
for its first official version at here.

I wrote a proof of concept tool, based on the ASPROX bot that has been
attacking millions of SQL-injection prone web sites running MS-SQL servers at their backends.
Given a list of URLs that can be retrieved using various crawlers found on the web, it tests for SQL injection via URL parameters. In case one works, it attemps to either inject defacement content as entered by the user or alternatively to run an OS command on the SQL server.

 

Main Features:
---------------
 

  1. Written in Python
  2. Uses the robust CURL library - fastest HTTP request crafter in the world
     
  3. Encodes payload query in binary format to encapsulate internal SQL syntax and evade IDS systems
  4. URL encodes all content to comply with standard GET requests
  5. Allows usage of HTTP proxy

ToDo:
------
 

  1. Parallelize URL attacks
  2. Attack web forms with POST requests
  3. Build GUI (IronPython...?)
     

Feature requests and bug reports are welcome at:

ravivr_at_gmail_dot_com

随机日志

分类: 技术文章 标签:
  1. 本文目前尚无任何评论.
  1. 本文目前尚无任何 trackbacks 和 pingbacks.