Publié le 12-04-2011 23:04 sur la mailing-list Dailydave

Pub : Découvrez les Labs ZATAZ

Hi,

We are glad to release sqlmap version 0.9.

Introduction
============
sqlmap is an open source penetration testing tool that automates the
process of detecting and exploiting SQL injection flaws and taking
over of database servers. It comes with a kick-ass detection engine,
many niche features for the ultimate penetration tester and a broad
range of switches lasting from database fingerprinting, over data
fetching from the database, to accessing the underlying file system
and executing commands on the operating system via out-of-band
connections.

Changes
=======
Some of the new features include:

* Rewritten SQL injection detection engine (Bernardo and Miroslav).
* Support to directly connect to the database without passing via a
SQL injection, -d switch (Bernardo and Miroslav).
* Added full support for both time-based blind SQL injection and
error-based SQL injection techniques (Bernardo and Miroslav).
* Implemented support for SQLite 2 and 3 (Bernardo and Miroslav).
* Implemented support for Firebird (Bernardo and Miroslav).
* Implemented support for Microsoft Access, Sybase and SAP MaxDB
(Miroslav).
* Added support to tamper injection data with --tamper switch (Bernardo
and Miroslav).
* Added automatic recognition of password hashes format and support to
crack them with a dictionary-based attack (Miroslav).
* Added support to fetch unicode data (Bernardo and Miroslav).
* Added support to use persistent HTTP(s) connection for speed
improvement, --keep-alive switch (Miroslav).
* Implemented several optimization switches to speed up the exploitation
of SQL injections (Bernardo and Miroslav).
* Support to parse and test forms on target url, --forms switch
(Bernardo and Miroslav).
* Added switches to brute-force tables names and columns names with a
dictionary attack, --common-tables and --common-columns. Useful for
instance when system table 'information_schema' is not available on
MySQL (Miroslav).

Complete list of changes at
https://svn.sqlmap.org/sqlmap/trunk/sqlmap/doc/ChangeLog.

Download
========
You can download it in two formats:

* Source gzip compressed,
http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.tar.gz
* Source zip compressed, http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.zip

Documentation
=============
* sqlmap user's manual: http://sqlmap.sourceforge.net/doc/README.pdf
* Conferences' material (whitepaper and slides):
http://sqlmap.sourceforge.net/#docs

Contribute
==========
We are looking for people who can write some clean Python code, are up
to do security research, know about web application security, database
assessment and takeover, software refactoring and are motivated to
join the development team.
If this sounds interesting to you, get in touch!

For the sceptical.. No, it's not only about web application. Yes, it
helps you also to get a command prompt on the target system. Yes, it
can be used to privilege escalate to SYSTEM if the target system is
Windows.

Not yet convinced that this tool is worth a try? Get some popcorns,
head to http://www.youtube.com/user/inquisb#g/u and watch some video
demonstrations.

Happy hacking!

--
Miroslav Stampar

E-mail: miroslav.stampar (at) gmail.com
PGP Key ID: 0xB5397B1B
_______________________________________________
Dailydave mailing list
[email protected]
https://lists.immunityinc.com/mailman/listinfo/dailydave

Votre compte Facebook a-t-il été infiltré ?

24-05-2012 à 12:09 - 0 commentaire(s)

Info zataz - Une vague de faux messages vise des milliers de comptes Français Facebook. Prudence aux photos sexy diffusées.

Fuite de données pour iPhone

22-05-2012 à 00:43 - 0 commentaire(s)

Info zataz - Un iPhone jailbreaké couplé avec Tweak Bulletin permet de passer outre le mot de passe d´ouverture du téléphone.

Téléphone portable ZTE piégé

22-05-2012 à 00:38 - 0 commentaire(s)

Le fabricant chinois de téléphone portable ZTE a confirmé la présence d'une porte dérobée dans l'un de ses smartphones sous Android.

Le Bureau de Justice US piraté

22-05-2012 à 00:31 - 0 commentaire(s)

Info zataz - Des milliers de données sensibles volées par des Anonymous au Bureau of Justice US.

Anonymous contre pédophiles

22-05-2012 à 00:09 - 0 commentaire(s)

Info ZATAZ : Plusieurs dizaines d´informations concernant des pédophiles présumés venant du réseau Darknet diffusées par des Anonymous.

Vulnérabilité sur les site de FHM, ELLE et Forbes

20-05-2012 à 20:38 - 0 commentaire(s)

Info zataz - Des failles découvertes sur les sites des magazines FHM, ELLE et Forbes peuvent mettre en danger les lecteurs internautes.

Anonymous menacent le gouvernement québécois

20-05-2012 à 20:28 - 0 commentaire(s)

Info @zataz - Le gouvernement Québécois veut faire interdire des manifestations étudiantes. Les Anonymous répondent en lançant des attaques informatiques.

Class action de 15 milliards contre Facebook

20-05-2012 à 20:23 - 0 commentaire(s)

Facebook rentre en bourse, des internautes lancent une Class Action de 15 milliards de dollars contre Facebook.