sqlmap

introduction

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection errors and supporting database servers. It includes a powerful detection engine, many niche functions for the ultimate penetration tester, and a wide range of switches from database fingerprints to database data access and access. to the underlying file system. tape connections.

Characteristics

Full support for MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix database management systems.
Full support for six SQL injection techniques: boolean, blind, time-based, error-based, on UNION request, on stacked and out-of-band requests.
Support for connecting directly to the database without SQL injection, providing DBMS credentials, IP address, port, and database name.
Support for enumerating users, password hashes, privileges, roles, databases, tables, and columns.
Automatic recognition of password hash formats and support for cracking using a dictionary-based attack.
Support to completely empty the database tables, a range of entries or specific columns according to the user's choice. The user can also choose to empty only a range of characters from the entry of each column.
Support for finding specific database names, specific tables in all databases, or specific columns in all database tables. This is useful, for example, for identifying tables that contain custom application credentials when the names of the relevant columns contain a string such as name and pass.
Support for downloading and downloading any file from the underlying file system of the database server when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
Support to execute arbitrary commands and retrieve their standard output on the underlying operating system of the database server when the database software is MySQL, PostgreSQL or Microsoft SQL Server.
Support for establishing an out-of-band TCP connection between the attacker's machine and the underlying operating system of the database server. This channel can be an interactive command prompt, a Meterpreter session, or a graphical user interface (VNC) session depending on the user's choice.
Support for escalating user privileges of the database process via Metasploit's getystemcontrol Meterpreter.

Sql V8.3 Download

Sql V9.6 Download

Privat Combo Download