The worlds only online SQL injection scanner... See for yourself

QHow do I use this application?

A To begin testing for SQL injections type in a fully qualified URL, then select the parameter in the query string of that URL you want to test for SQL injections.

Assume we have typed the following URL:

http://www.example.com?arg1=foo&arg2=bar

The above URL contains two paramaters in the query string, we can test both of them for SQL injections. First select arg1 from the drop down and press the 'TEST' button to begin testing this paramater for SQL injection vulnerabilites. If this parameter does not contain any SQL injection vulnerabilities select arg2 from the drop down and begin testing this parameter for SQL inection vulnerablities.

If this parameter does contain a SQL injection vulnerability then you will be presented with some operations that you can peform on the database, these operations will allow you to extract information from the database. Select one of these operations to begin execution on the target URL.

If you selected the 'Database Vesion' operation you should see something like this as the result:

[INFO] Attempting to identify the DBMS version.
[INFO] Extracted DBMS version:
**************************************************************************
5.0.51a-3ubuntu5.1
**************************************************************************
[INFO] Performed 132 queries in 8.909 secs.

QWhat data can I extract from a database:

A Given a parameter with SQL injection vulnerablities and the current DB user has the relevant privileges to access system information we can extract:

QWhat Database Technologies do you support?

A We have support for the following SQL Database technologies:

QWhat is a SQL Injection?

A SQL injection is a technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is in fact an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another.
For a more detailed explanation of SQL Injection click here

QHow do SQL Injections work?

A SQL Injections work by appending our own SQL statements to a parameter which is not correctly sanitised on the server. If you look at the following line of code:

$query = "select PRODUCTNAME, PRODUCTDESC, PRODUCTPRICE FROM PRODUCT WHERE ID = " . $_GET[ 'ID' ];

The above line of code is a very common example of an SQL injection vulnerability. The URL parameter ID is not integorated before being appended to the query. So what does this mean? In a normal situation the argument ID will be be a number that identifies a product in the database 123 for example, but because it is not escaped there is nothing stopping us from putting what ever value we want into it.

Imagine we change the URL parameter ID to the following: http://www.example.com?arg=123 AND 1 = 1

When this gets appended to the query we will have this:

$query = "select PRODUCTNAME, PRODUCTDESC, PRODUCTPRICE FROM PRODUCT WHERE ID = 123 AND 1 = 1".

This is a valid SQL statement and as 1 always equals 1 the statement will execute normally. Now we change the URL parameter ID to http://www.example.com?arg=123 AND 1 = 2. The query will now look like this:

$query = "select PRODUCTNAME, PRODUCTDESC, PRODUCTPRICE FROM PRODUCT WHERE ID = 123 AND 1 = 2"

This is a valid SQL statement and as 1 never equals 2 the statement will fail and return no results. Using this technique we have successfully identified a SQL injection vulnerability and we also have a true/false datum needed to extract information from the database.

QHow do you extract data using SQL Injections?

A To extract data from the database we use a technique known as blind SQL injection or inference SQL injection.

This technique uses the knowledge of a true and false result as well as native SQL string functions to enumerate information contained with in the database. Imagine we have a URL: http://www.example.com?ID=123, in the previous answer we established a method for finding a true and false result for this query.

Lets try another query:

$query = "select PRODUCTNAME, PRODUCTDESC, PRODUCTPRICE FROM PRODUCT WHERE ID = 123 AND (ASCII(SUBSTRING((SELECT 'RORY'),1,1))) > 63

The above query uses the substring function to get a substring of length 1 starting at index 1 of the string 'RORY', this will return the character 'R', the ascii function returns the ascii value of 'R' which is 82. The above query can therefore be written as:

$query = "select PRODUCTNAME, PRODUCTDESC, PRODUCTPRICE FROM PRODUCT WHERE ID = 123 AND 82 > 63

This is a valid SQL statement and will return a true result as 82 is always greater than 63. A bisection algorithm is used to calculate the exact value of the character, this algorithm requires 7 queries to calculate a single character in the target output. It basically uses a higher/lower guessing logic to determine the value of the character. This technique can be applied to every character in the otuput text to determine its value.