I just uploaded my talk Hashdays 2012 „Self-Defending Databases“ to the Red-Database-Security website. The talk explains how to detect SQL Injection attacks in databases (Oracle/MSSQL/MySQL) and how to react in case of a SQL Injection (e.g. done with Pangolin, Havij or Netsparker).
Initially the idea covered only Oracle and MSSQL but Xavier Mertens extend the concept to MySQL (MySQL Attacks Self-Detection) after he saw my presentation at the Hashdays Management Session.
Today I want to present the Netsparker Community Edition.
Netsparker (from Mavituna Security) is the best web application scanner I know. Easy to use and a really good web application scanning results. It saved me a lot of time and helped me to find security bugs in Oracle applications (Enterprise Manager).
The best thing: The new community edition is free (OK, with some limitations).
The commercial versions have even more interesting features like Time Based Blind SQL Injection, Remote Code Injection, OS Level Command Injection , CRLF / HTTP Header Injection / Response Splitting, …. The entire feature (and price) list is available here.
Here is a screenshot from Netsparker:
If you are interested just download the community edition.
The latest version 3.0 of our database scanner Repscan is now available. This new version supports MS SQL Server and Oracle databases. Repscan comes with a large amount of new features and a complete new GUI (First database scanner with Office-2007 UI).
Here some of the new features of Repscan 3.0:
Here some (old) features of Repscan:
Here some statements of Repscan 3.0 users:
„Repscan Rocks“, „I must have this tool.“, „Very cool stuff“, „really like the clean interface… checks are great“, „…tend to be more Oracle security information hub than just scanner :-)“
Over the next few weeks I will show here more details of some Repscan 3.0 features.
If you want to test Repscan 3.0 you can download it from our exclusive distributor Sentrigo
Yesterday Bernardo Damele released sqlmap 0.7 rc1 for Linux. This new version of SQLMap was published at the Blackhat Europe and allows the execution of OS commands on SQL Server, MySQL and Postgres.
Oracle is not part of it but I am quite sure sooner or later the execution of Oracle commands will be supported as well…
The blackhat presentation „Advanced SQL injection to operating system full control“ is also available for download.