Vulnerability Analysis / Database Assessment Complete

tools/oscanner.md

@@ -0,0 +1,24 @@
+# OracleScanner
+
+Notes
+-------
+
+Help Text
+-------
+```
+	Oracle Scanner 1.0.6 by patrik@cqure.net
+	--------------------------------------
+	OracleScanner -s <ip> -r <repfile> [options]
+		-s	<servername>
+		-f	<serverlist>
+		-P	<portnr>
+		-v	be verbose
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/osscanner.md

@@ -0,0 +1,24 @@
+# oscanner - OracleScanner
+
+Notes
+-------
+
+Help Text
+-------
+```
+	Oracle Scanner 1.0.6 by patrik@cqure.net
+	--------------------------------------
+	OracleScanner -s <ip> -r <repfile> [options]
+		-s	<servername>
+		-f	<serverlist>
+		-P	<portnr>
+		-v	be verbose
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/sidguess.md

@@ -0,0 +1,25 @@
+# sidguess - SidGuesser
+
+Notes
+-------
+
+Help Text
+-------
+```
+SIDGuesser v1.0.5 by patrik@cqure.net
+-------------------------------------
+sidguess -i <ip> -d <dictionary> [options]
+
+options:
+    -p <portnr> Use specific port (default 1521)
+    -r <report> Report to file
+    -m <mode>   findfirst OR findall(default)
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/sqldict.md

@@ -0,0 +1,20 @@
+# sqldict
+
+Notes
+-------
+Compiler's note: need to add visual screen shots of this tool.
+
+Help Text
+-------
+```
+Usage instructions 
+
+Download the exe file and run it. Specify the target server IP address, the target account name, and select a password list file to use for the dictionary attack. 
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/sqlmap.md

@@ -0,0 +1,248 @@
+# sqlmap
+
+Notes
+-------
+
+Help Text
+-------
+```
+Options:
+  -h, --help            Show basic help message and exit
+  -hh                   Show advanced help message and exit
+  --version             Show program's version number and exit
+  -v VERBOSE            Verbosity level: 0-6 (default 1)
+
+  Target:
+    At least one of these options has to be provided to set the target(s)
+
+    -d DIRECT           Direct connection to the database
+    -u URL, --url=URL   Target URL (e.g. "www.target.com/vuln.php?id=1")
+    -l LOGFILE          Parse targets from Burp or WebScarab proxy logs
+    -m BULKFILE         Scan multiple targets enlisted in a given textual file
+    -r REQUESTFILE      Load HTTP request from a file
+    -g GOOGLEDORK       Process Google dork results as target URLs
+    -c CONFIGFILE       Load options from a configuration INI file
+
+  Request:
+    These options can be used to specify how to connect to the target URL
+
+    --data=DATA         Data string to be sent through POST
+    --param-del=PDEL    Character used for splitting parameter values
+    --cookie=COOKIE     HTTP Cookie header
+    --cookie-del=CDEL   Character used for splitting cookie values
+    --load-cookies=L..  File containing cookies in Netscape/wget format
+    --drop-set-cookie   Ignore Set-Cookie header from response
+    --user-agent=AGENT  HTTP User-Agent header
+    --random-agent      Use randomly selected HTTP User-Agent header
+    --host=HOST         HTTP Host header
+    --referer=REFERER   HTTP Referer header
+    --headers=HEADERS   Extra headers (e.g. "Accept-Language: fr\nETag: 123")
+    --auth-type=AUTH..  HTTP authentication type (Basic, Digest, NTLM or PKI)
+    --auth-cred=AUTH..  HTTP authentication credentials (name:password)
+    --auth-private=A..  HTTP authentication PEM private key file
+    --proxy=PROXY       Use a proxy to connect to the target URL
+    --proxy-cred=PRO..  Proxy authentication credentials (name:password)
+    --proxy-file=PRO..  Load proxy list from a file
+    --ignore-proxy      Ignore system default proxy settings
+    --tor               Use Tor anonymity network
+    --tor-port=TORPORT  Set Tor proxy port other than default
+    --tor-type=TORTYPE  Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5)
+    --check-tor         Check to see if Tor is used properly
+    --delay=DELAY       Delay in seconds between each HTTP request
+    --timeout=TIMEOUT   Seconds to wait before timeout connection (default 30)
+    --retries=RETRIES   Retries when the connection timeouts (default 3)
+    --randomize=RPARAM  Randomly change value for given parameter(s)
+    --safe-url=SAFURL   URL address to visit frequently during testing
+    --safe-freq=SAFREQ  Test requests between two visits to a given safe URL
+    --skip-urlencode    Skip URL encoding of payload data
+    --force-ssl         Force usage of SSL/HTTPS
+    --hpp               Use HTTP parameter pollution
+    --eval=EVALCODE     Evaluate provided Python code before the request (e.g.
+                        "import hashlib;id2=hashlib.md5(id).hexdigest()")
+
+  Optimization:
+    These options can be used to optimize the performance of sqlmap
+
+    -o                  Turn on all optimization switches
+    --predict-output    Predict common queries output
+    --keep-alive        Use persistent HTTP(s) connections
+    --null-connection   Retrieve page length without actual HTTP response body
+    --threads=THREADS   Max number of concurrent HTTP(s) requests (default 1)
+
+  Injection:
+    These options can be used to specify which parameters to test for,
+    provide custom injection payloads and optional tampering scripts
+
+    -p TESTPARAMETER    Testable parameter(s)
+    --skip=SKIP         Skip testing for given parameter(s)
+    --dbms=DBMS         Force back-end DBMS to this value
+    --dbms-cred=DBMS..  DBMS authentication credentials (user:password)
+    --os=OS             Force back-end DBMS operating system to this value
+    --invalid-bignum    Use big numbers for invalidating values
+    --invalid-logical   Use logical operations for invalidating values
+    --invalid-string    Use random strings for invalidating values
+    --no-cast           Turn off payload casting mechanism
+    --no-escape         Turn off string escaping mechanism
+    --prefix=PREFIX     Injection payload prefix string
+    --suffix=SUFFIX     Injection payload suffix string
+    --tamper=TAMPER     Use given script(s) for tampering injection data
+
+  Detection:
+    These options can be used to customize the detection phase
+
+    --level=LEVEL       Level of tests to perform (1-5, default 1)
+    --risk=RISK         Risk of tests to perform (0-3, default 1)
+    --string=STRING     String to match when query is evaluated to True
+    --not-string=NOT..  String to match when query is evaluated to False
+    --regexp=REGEXP     Regexp to match when query is evaluated to True
+    --code=CODE         HTTP code to match when query is evaluated to True
+    --text-only         Compare pages based only on the textual content
+    --titles            Compare pages based only on their titles
+
+  Techniques:
+    These options can be used to tweak testing of specific SQL injection
+    techniques
+
+    --technique=TECH    SQL injection techniques to use (default "BEUSTQ")
+    --time-sec=TIMESEC  Seconds to delay the DBMS response (default 5)
+    --union-cols=UCOLS  Range of columns to test for UNION query SQL injection
+    --union-char=UCHAR  Character to use for bruteforcing number of columns
+    --union-from=UFROM  Table to use in FROM part of UNION query SQL injection
+    --dns-domain=DNS..  Domain name used for DNS exfiltration attack
+    --second-order=S..  Resulting page URL searched for second-order response
+
+  Fingerprint:
+    -f, --fingerprint   Perform an extensive DBMS version fingerprint
+
+  Enumeration:
+    These options can be used to enumerate the back-end database
+    management system information, structure and data contained in the
+    tables. Moreover you can run your own SQL statements
+
+    -a, --all           Retrieve everything
+    -b, --banner        Retrieve DBMS banner
+    --current-user      Retrieve DBMS current user
+    --current-db        Retrieve DBMS current database
+    --hostname          Retrieve DBMS server hostname
+    --is-dba            Detect if the DBMS current user is DBA
+    --users             Enumerate DBMS users
+    --passwords         Enumerate DBMS users password hashes
+    --privileges        Enumerate DBMS users privileges
+    --roles             Enumerate DBMS users roles
+    --dbs               Enumerate DBMS databases
+    --tables            Enumerate DBMS database tables
+    --columns           Enumerate DBMS database table columns
+    --schema            Enumerate DBMS schema
+    --count             Retrieve number of entries for table(s)
+    --dump              Dump DBMS database table entries
+    --dump-all          Dump all DBMS databases tables entries
+    --search            Search column(s), table(s) and/or database name(s)
+    --comments          Retrieve DBMS comments
+    -D DB               DBMS database to enumerate
+    -T TBL              DBMS database table(s) to enumerate
+    -C COL              DBMS database table column(s) to enumerate
+    -X EXCLUDECOL       DBMS database table column(s) to not enumerate
+    -U USER             DBMS user to enumerate
+    --exclude-sysdbs    Exclude DBMS system databases when enumerating tables
+    --where=DUMPWHERE   Use WHERE condition while table dumping
+    --start=LIMITSTART  First query output entry to retrieve
+    --stop=LIMITSTOP    Last query output entry to retrieve
+    --first=FIRSTCHAR   First query output word character to retrieve
+    --last=LASTCHAR     Last query output word character to retrieve
+    --sql-query=QUERY   SQL statement to be executed
+    --sql-shell         Prompt for an interactive SQL shell
+    --sql-file=SQLFILE  Execute SQL statements from given file(s)
+
+  Brute force:
+    These options can be used to run brute force checks
+
+    --common-tables     Check existence of common tables
+    --common-columns    Check existence of common columns
+
+  User-defined function injection:
+    These options can be used to create custom user-defined functions
+
+    --udf-inject        Inject custom user-defined functions
+    --shared-lib=SHLIB  Local path of the shared library
+
+  File system access:
+    These options can be used to access the back-end database management
+    system underlying file system
+
+    --file-read=RFILE   Read a file from the back-end DBMS file system
+    --file-write=WFILE  Write a local file on the back-end DBMS file system
+    --file-dest=DFILE   Back-end DBMS absolute filepath to write to
+
+  Operating system access:
+    These options can be used to access the back-end database management
+    system underlying operating system
+
+    --os-cmd=OSCMD      Execute an operating system command
+    --os-shell          Prompt for an interactive operating system shell
+    --os-pwn            Prompt for an OOB shell, meterpreter or VNC
+    --os-smbrelay       One click prompt for an OOB shell, meterpreter or VNC
+    --os-bof            Stored procedure buffer overflow exploitation
+    --priv-esc          Database process user privilege escalation
+    --msf-path=MSFPATH  Local path where Metasploit Framework is installed
+    --tmp-path=TMPPATH  Remote absolute path of temporary files directory
+
+  Windows registry access:
+    These options can be used to access the back-end database management
+    system Windows registry
+
+    --reg-read          Read a Windows registry key value
+    --reg-add           Write a Windows registry key value data
+    --reg-del           Delete a Windows registry key value
+    --reg-key=REGKEY    Windows registry key
+    --reg-value=REGVAL  Windows registry key value
+    --reg-data=REGDATA  Windows registry key value data
+    --reg-type=REGTYPE  Windows registry key value type
+
+  General:
+    These options can be used to set some general working parameters
+
+    -s SESSIONFILE      Load session from a stored (.sqlite) file
+    -t TRAFFICFILE      Log all HTTP traffic into a textual file
+    --batch             Never ask for user input, use the default behaviour
+    --charset=CHARSET   Force character encoding used for data retrieval
+    --crawl=CRAWLDEPTH  Crawl the website starting from the target URL
+    --csv-del=CSVDEL    Delimiting character used in CSV output (default ",")
+    --dump-format=DU..  Format of dumped data (CSV (default), HTML or SQLITE)
+    --eta               Display for each output the estimated time of arrival
+    --flush-session     Flush session files for current target
+    --forms             Parse and test forms on target URL
+    --fresh-queries     Ignore query results stored in session file
+    --hex               Use DBMS hex function(s) for data retrieval
+    --output-dir=ODIR   Custom output directory path
+    --parse-errors      Parse and display DBMS error messages from responses
+    --pivot-column=P..  Pivot column name
+    --save              Save options to a configuration INI file
+    --scope=SCOPE       Regexp to filter targets from provided proxy log
+    --test-filter=TE..  Select tests by payloads and/or titles (e.g. ROW)
+    --update            Update sqlmap
+
+  Miscellaneous:
+    -z MNEMONICS        Use short mnemonics (e.g. "flu,bat,ban,tec=EU")
+    --alert=ALERT       Run host OS command(s) when SQL injection is found
+    --answers=ANSWERS   Set question answers (e.g. "quit=N,follow=N")
+    --beep              Make a beep sound when SQL injection is found
+    --check-waf         Heuristically check for WAF/IPS/IDS protection
+    --cleanup           Clean up the DBMS from sqlmap specific UDF and tables
+    --dependencies      Check for missing (non-core) sqlmap dependencies
+    --disable-coloring  Disable console output coloring
+    --gpage=GOOGLEPAGE  Use Google dork results from specified page number
+    --identify-waf      Make a through testing for a WAF/IPS/IDS protection
+    --mobile            Imitate smartphone through HTTP User-Agent header
+    --page-rank         Display page rank (PR) for Google dork results
+    --purge-output      Safely remove all content from output directory
+    --smart             Conduct through tests only if positive heuristic(s)
+    --wizard            Simple wizard interface for beginner users
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/sqlninja.md

@@ -0,0 +1,46 @@
+# sqlninja
+
+Notes
+-------
+
+Help Text
+-------
+```
+Sqlninja rel. 0.2.6-r1
+Copyright (C) 2006-2011 icesurfer <r00t@northernfortress.net>
+Usage: /usr/bin/sqlninja
+	-m <mode> : Required. Available modes are:
+	    t/test - test whether the injection is working
+	    f/fingerprint - fingerprint user, xp_cmdshell and more
+	    b/bruteforce - bruteforce sa account
+	    e/escalation - add user to sysadmin server role
+	    x/resurrectxp - try to recreate xp_cmdshell
+	    u/upload - upload a .scr file
+	    s/dirshell - start a direct shell
+	    k/backscan - look for an open outbound port
+	    r/revshell - start a reverse shell
+	    d/dnstunnel - attempt a dns tunneled shell
+	    i/icmpshell - start a reverse ICMP shell
+	    c/sqlcmd - issue a 'blind' OS command
+	    m/metasploit - wrapper to Metasploit stagers
+	-f <file> : configuration file (default: sqlninja.conf)
+	-p <password> : sa password
+	-w <wordlist> : wordlist to use in bruteforce mode (dictionary method
+	                only)
+	-g : generate debug script and exit (only valid in upload mode)
+	-v : verbose output
+	-d <mode> : activate debug
+	    1 - print each injected command
+	    2 - print each raw HTTP request
+	    3 - print each raw HTTP response
+	    all - all of the above
+	...see sqlninja-howto.html for details
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/sqlsus.md

@@ -0,0 +1,29 @@
+# sqlsus
+
+Notes
+-------
+
+Help Text
+-------
+```
+              sqlsus version 0.7.2
+
+  Copyright (c) 2008-2011 Jérémy Ruffet (sativouf)
+
+Usage:
+    sqlsus [options] [config file]
+
+     Options:
+         -h, --help                    brief help message
+         -v, --version                 version information
+         -e, --execute <commands>      execute commands and exit
+         -g, --genconf <filename>      generate configuration file
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

tools/tnscmd10g.md

@@ -0,0 +1,26 @@
+# tnscmd10g
+
+Notes
+-------
+
+Help Text
+-------
+```
+usage: /usr/bin/tnscmd10g [command] -h hostname
+       where 'command' is something like ping, version, status, etc.  
+       (default is ping)
+       [-p port] - alternate TCP port to use (default is 1521)
+       [--logfile logfile] - write raw packets to specified logfile
+       [--indent] - indent & outdent on parens
+       [--10G] - make it work against 10G
+       [--rawcmd command] - build your own CONNECT_DATA string
+       [--cmdsize bytes] - fake TNS command size (reveals packet leakage)
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+

vulnanalysis/index.md

@@ -18,15 +18,15 @@ Database Assessment
  * [mdb-export](../tools/mdb-export.md)
  * [mdb-hexdump](../tools/mdb-dump.md)
  * [mdb-parsecsv](../tools/mdb-parsecsv.md)
- * [mdb-sql](../tools/mdb-sql)
- * [mdb-tables](../tools/mdb-tables)
- * [oscanner]
- * [sidguesser]
- * [sqldict]
- * [sqlmap]
- * [sqlninja]
- * [sqlsus]
- * [tnscmd10g]
+ * [mdb-sql](../tools/mdb-sql.md)
+ * [mdb-tables](../tools/mdb-tables.md)
+ * [oscanner](../tools/oscanner.md)
+ * [sidguesser](../tools/sidguess.md)
+ * [sqldict](../tools/sqldict.md)
+ * [sqlmap](../tools/sqlmap.md)
+ * [sqlninja](../tools/sqlninja.md)
+ * [sqlsus](../tools/sqlsus.md)
+ * [tnscmd10g](../tools/tnscmd10g.md)
 
 Fuzzing Tools
 -------------