Today, we announced SQL Invader, a new free GUI-based tool that enables testers to easily and quickly exploit a SQL Injection vulnerability, get a proof of concept with database visibility and export results into a csv file. In just a few clicks, users will be able to view the list of records, tables and user accounts on the back-end database.
Tools like this are still critical for comprehensive application security testing and can help organizations remain a step ahead of the bad guys. SQL Injection has been the dominant method used in this year’s high-profile web application attacks; with millions of sites attacked in 2011.
We created this tool because our customers and the community at large have expressed a need. We want to always contribute to the community as much as we can. Although SQL Injection is well documented and there are tools to discover the vulnerabilities, it has been very difficult to determine if the vulnerability can actually be exploited because most existing SQL Injection testing tools are executed from a command line, lack an intuitive user interface or are no longer supported. Without the ability to clearly demonstrate the exploitability of a vulnerability, remediation efforts are often delayed and friction between security and development teams surfaces. We designed NTO SQL Invader so that penetration testers and developers can quickly and easily leverage a vulnerability to view the list of records, tables and user accounts on the back-end database.
SQL Invader works as a standalone solution or with NTOSpider and enables you to:
- Paste the injectable request straight from an application scan report
- Control how much information is harvested.
- View data in an organized manner using tree control and data grids.
- Leverage logging data in CSV file
Learn more and download NTO SQL Invader today.
Last updated by at .
Why create yet another tool that will need to be maintained, and will slowly stagnate from lack of attention, and not contribute to an existing and terrific open source project like SQLMap?
Hi Joe,
We do plan to contribute back to SQLMap and we do use the same database format as SQLMap. To some degree you can think of this as a SQLMap re-write into java, with the addition of a slick graphical interface. We will be contributing to the SQLMap database and will allow users to update from the latest open source database.
Dan