The mass SQL injection attacks we talked about in in several posts, being mainly targeted to ASP sites running on Microsoft IIS and backed by Microsoft SQL Server, gathered lots of (quite undeserved) bad press to Microsoft.
Therefore the Microsoft Security Response Center felt the need to do something more than saying “blame developers for their poor coding practiceâ€, and asked the HP Web Security Research Group (formerly SPI Labs) to create a tool helping site owners to identify their SQL injection holes.
So now, after one month of development, HP is announcing Scrawlr, the “SQL Injector and Crawlerâ€.
Scrawl can be dowloaded here.
Of course, once you've found your site is vulnerable (and if you're in doubt, it's 99% likely to be) you still need to plug your holes.
hackademix.net - Giorgio Maone's answers to the Web, the Universe, and Everything
Therefore the Microsoft Security Response Center felt the need to do something more than saying “blame developers for their poor coding practiceâ€, and asked the HP Web Security Research Group (formerly SPI Labs) to create a tool helping site owners to identify their SQL injection holes.
So now, after one month of development, HP is announcing Scrawlr, the “SQL Injector and Crawlerâ€.
Scrawlr will crawl a website while simultaneously analyzing the parameters of each individual web page for SQL Injection vulnerabilities. […] It can even provide proof positive results by displaying the type of backend database in use and a list of available table names. There is no denying you have SQL Injection when I can show you table names!
Scrawl can be thought as a free version of the professional scanners in HP's products portfolio, with some limitations making it suitable for self-diagnosis of your site in the specific context of this kind of non-targeted massive attacks, which usually inject URL query parameters from links, rather than POST requests from forms. In facts, it
- Will only crawl up to 1500 pages
- Does not support sites requiring authentication
- Does not perform Blind SQL injection
- Cannot retrieve database contents
- Does not support JavaScript or flash parsing
- Will not test forms for SQL Injection (POST Parameters)
Of course, once you've found your site is vulnerable (and if you're in doubt, it's 99% likely to be) you still need to plug your holes.
hackademix.net - Giorgio Maone's answers to the Web, the Universe, and Everything
