From f36b6ac070d2c0493c0a2bf0869bc1cfe1ae9665 Mon Sep 17 00:00:00 2001 From: Will Pennell Date: Fri, 4 Apr 2014 22:11:37 -0400 Subject: [PATCH] Vulnerability Analysis / Database Assessment Complete --- tools/oscanner.md | 24 ++++ tools/osscanner.md | 24 ++++ tools/sidguess.md | 25 +++++ tools/sqldict.md | 20 ++++ tools/sqlmap.md | 248 ++++++++++++++++++++++++++++++++++++++++++ tools/sqlninja.md | 46 ++++++++ tools/sqlsus.md | 29 +++++ tools/tnscmd10g.md | 26 +++++ vulnanalysis/index.md | 18 +-- 9 files changed, 451 insertions(+), 9 deletions(-) create mode 100644 tools/oscanner.md create mode 100644 tools/osscanner.md create mode 100644 tools/sidguess.md create mode 100644 tools/sqldict.md create mode 100644 tools/sqlmap.md create mode 100644 tools/sqlninja.md create mode 100644 tools/sqlsus.md create mode 100644 tools/tnscmd10g.md diff --git a/tools/oscanner.md b/tools/oscanner.md new file mode 100644 index 0000000..2cebbf8 --- /dev/null +++ b/tools/oscanner.md @@ -0,0 +1,24 @@ +# OracleScanner + +Notes +------- + +Help Text +------- +``` + Oracle Scanner 1.0.6 by patrik@cqure.net + -------------------------------------- + OracleScanner -s -r [options] + -s + -f + -P + -v be verbose + +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/osscanner.md b/tools/osscanner.md new file mode 100644 index 0000000..33a450f --- /dev/null +++ b/tools/osscanner.md @@ -0,0 +1,24 @@ +# oscanner - OracleScanner + +Notes +------- + +Help Text +------- +``` + Oracle Scanner 1.0.6 by patrik@cqure.net + -------------------------------------- + OracleScanner -s -r [options] + -s + -f + -P + -v be verbose + +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/sidguess.md b/tools/sidguess.md new file mode 100644 index 0000000..76fcb02 --- /dev/null +++ b/tools/sidguess.md @@ -0,0 +1,25 @@ +# sidguess - SidGuesser + +Notes +------- + +Help Text +------- +``` +SIDGuesser v1.0.5 by patrik@cqure.net +------------------------------------- +sidguess -i -d [options] + +options: + -p Use specific port (default 1521) + -r Report to file + -m findfirst OR findall(default) + +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/sqldict.md b/tools/sqldict.md new file mode 100644 index 0000000..71a1150 --- /dev/null +++ b/tools/sqldict.md @@ -0,0 +1,20 @@ +# sqldict + +Notes +------- +Compiler's note: need to add visual screen shots of this tool. + +Help Text +------- +``` +Usage instructions + +Download the exe file and run it. Specify the target server IP address, the target account name, and select a password list file to use for the dictionary attack. +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/sqlmap.md b/tools/sqlmap.md new file mode 100644 index 0000000..e4671b1 --- /dev/null +++ b/tools/sqlmap.md @@ -0,0 +1,248 @@ +# sqlmap + +Notes +------- + +Help Text +------- +``` +Options: + -h, --help Show basic help message and exit + -hh Show advanced help message and exit + --version Show program's version number and exit + -v VERBOSE Verbosity level: 0-6 (default 1) + + Target: + At least one of these options has to be provided to set the target(s) + + -d DIRECT Direct connection to the database + -u URL, --url=URL Target URL (e.g. "www.target.com/vuln.php?id=1") + -l LOGFILE Parse targets from Burp or WebScarab proxy logs + -m BULKFILE Scan multiple targets enlisted in a given textual file + -r REQUESTFILE Load HTTP request from a file + -g GOOGLEDORK Process Google dork results as target URLs + -c CONFIGFILE Load options from a configuration INI file + + Request: + These options can be used to specify how to connect to the target URL + + --data=DATA Data string to be sent through POST + --param-del=PDEL Character used for splitting parameter values + --cookie=COOKIE HTTP Cookie header + --cookie-del=CDEL Character used for splitting cookie values + --load-cookies=L.. File containing cookies in Netscape/wget format + --drop-set-cookie Ignore Set-Cookie header from response + --user-agent=AGENT HTTP User-Agent header + --random-agent Use randomly selected HTTP User-Agent header + --host=HOST HTTP Host header + --referer=REFERER HTTP Referer header + --headers=HEADERS Extra headers (e.g. "Accept-Language: fr\nETag: 123") + --auth-type=AUTH.. HTTP authentication type (Basic, Digest, NTLM or PKI) + --auth-cred=AUTH.. HTTP authentication credentials (name:password) + --auth-private=A.. HTTP authentication PEM private key file + --proxy=PROXY Use a proxy to connect to the target URL + --proxy-cred=PRO.. Proxy authentication credentials (name:password) + --proxy-file=PRO.. Load proxy list from a file + --ignore-proxy Ignore system default proxy settings + --tor Use Tor anonymity network + --tor-port=TORPORT Set Tor proxy port other than default + --tor-type=TORTYPE Set Tor proxy type (HTTP (default), SOCKS4 or SOCKS5) + --check-tor Check to see if Tor is used properly + --delay=DELAY Delay in seconds between each HTTP request + --timeout=TIMEOUT Seconds to wait before timeout connection (default 30) + --retries=RETRIES Retries when the connection timeouts (default 3) + --randomize=RPARAM Randomly change value for given parameter(s) + --safe-url=SAFURL URL address to visit frequently during testing + --safe-freq=SAFREQ Test requests between two visits to a given safe URL + --skip-urlencode Skip URL encoding of payload data + --force-ssl Force usage of SSL/HTTPS + --hpp Use HTTP parameter pollution + --eval=EVALCODE Evaluate provided Python code before the request (e.g. + "import hashlib;id2=hashlib.md5(id).hexdigest()") + + Optimization: + These options can be used to optimize the performance of sqlmap + + -o Turn on all optimization switches + --predict-output Predict common queries output + --keep-alive Use persistent HTTP(s) connections + --null-connection Retrieve page length without actual HTTP response body + --threads=THREADS Max number of concurrent HTTP(s) requests (default 1) + + Injection: + These options can be used to specify which parameters to test for, + provide custom injection payloads and optional tampering scripts + + -p TESTPARAMETER Testable parameter(s) + --skip=SKIP Skip testing for given parameter(s) + --dbms=DBMS Force back-end DBMS to this value + --dbms-cred=DBMS.. DBMS authentication credentials (user:password) + --os=OS Force back-end DBMS operating system to this value + --invalid-bignum Use big numbers for invalidating values + --invalid-logical Use logical operations for invalidating values + --invalid-string Use random strings for invalidating values + --no-cast Turn off payload casting mechanism + --no-escape Turn off string escaping mechanism + --prefix=PREFIX Injection payload prefix string + --suffix=SUFFIX Injection payload suffix string + --tamper=TAMPER Use given script(s) for tampering injection data + + Detection: + These options can be used to customize the detection phase + + --level=LEVEL Level of tests to perform (1-5, default 1) + --risk=RISK Risk of tests to perform (0-3, default 1) + --string=STRING String to match when query is evaluated to True + --not-string=NOT.. String to match when query is evaluated to False + --regexp=REGEXP Regexp to match when query is evaluated to True + --code=CODE HTTP code to match when query is evaluated to True + --text-only Compare pages based only on the textual content + --titles Compare pages based only on their titles + + Techniques: + These options can be used to tweak testing of specific SQL injection + techniques + + --technique=TECH SQL injection techniques to use (default "BEUSTQ") + --time-sec=TIMESEC Seconds to delay the DBMS response (default 5) + --union-cols=UCOLS Range of columns to test for UNION query SQL injection + --union-char=UCHAR Character to use for bruteforcing number of columns + --union-from=UFROM Table to use in FROM part of UNION query SQL injection + --dns-domain=DNS.. Domain name used for DNS exfiltration attack + --second-order=S.. Resulting page URL searched for second-order response + + Fingerprint: + -f, --fingerprint Perform an extensive DBMS version fingerprint + + Enumeration: + These options can be used to enumerate the back-end database + management system information, structure and data contained in the + tables. Moreover you can run your own SQL statements + + -a, --all Retrieve everything + -b, --banner Retrieve DBMS banner + --current-user Retrieve DBMS current user + --current-db Retrieve DBMS current database + --hostname Retrieve DBMS server hostname + --is-dba Detect if the DBMS current user is DBA + --users Enumerate DBMS users + --passwords Enumerate DBMS users password hashes + --privileges Enumerate DBMS users privileges + --roles Enumerate DBMS users roles + --dbs Enumerate DBMS databases + --tables Enumerate DBMS database tables + --columns Enumerate DBMS database table columns + --schema Enumerate DBMS schema + --count Retrieve number of entries for table(s) + --dump Dump DBMS database table entries + --dump-all Dump all DBMS databases tables entries + --search Search column(s), table(s) and/or database name(s) + --comments Retrieve DBMS comments + -D DB DBMS database to enumerate + -T TBL DBMS database table(s) to enumerate + -C COL DBMS database table column(s) to enumerate + -X EXCLUDECOL DBMS database table column(s) to not enumerate + -U USER DBMS user to enumerate + --exclude-sysdbs Exclude DBMS system databases when enumerating tables + --where=DUMPWHERE Use WHERE condition while table dumping + --start=LIMITSTART First query output entry to retrieve + --stop=LIMITSTOP Last query output entry to retrieve + --first=FIRSTCHAR First query output word character to retrieve + --last=LASTCHAR Last query output word character to retrieve + --sql-query=QUERY SQL statement to be executed + --sql-shell Prompt for an interactive SQL shell + --sql-file=SQLFILE Execute SQL statements from given file(s) + + Brute force: + These options can be used to run brute force checks + + --common-tables Check existence of common tables + --common-columns Check existence of common columns + + User-defined function injection: + These options can be used to create custom user-defined functions + + --udf-inject Inject custom user-defined functions + --shared-lib=SHLIB Local path of the shared library + + File system access: + These options can be used to access the back-end database management + system underlying file system + + --file-read=RFILE Read a file from the back-end DBMS file system + --file-write=WFILE Write a local file on the back-end DBMS file system + --file-dest=DFILE Back-end DBMS absolute filepath to write to + + Operating system access: + These options can be used to access the back-end database management + system underlying operating system + + --os-cmd=OSCMD Execute an operating system command + --os-shell Prompt for an interactive operating system shell + --os-pwn Prompt for an OOB shell, meterpreter or VNC + --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC + --os-bof Stored procedure buffer overflow exploitation + --priv-esc Database process user privilege escalation + --msf-path=MSFPATH Local path where Metasploit Framework is installed + --tmp-path=TMPPATH Remote absolute path of temporary files directory + + Windows registry access: + These options can be used to access the back-end database management + system Windows registry + + --reg-read Read a Windows registry key value + --reg-add Write a Windows registry key value data + --reg-del Delete a Windows registry key value + --reg-key=REGKEY Windows registry key + --reg-value=REGVAL Windows registry key value + --reg-data=REGDATA Windows registry key value data + --reg-type=REGTYPE Windows registry key value type + + General: + These options can be used to set some general working parameters + + -s SESSIONFILE Load session from a stored (.sqlite) file + -t TRAFFICFILE Log all HTTP traffic into a textual file + --batch Never ask for user input, use the default behaviour + --charset=CHARSET Force character encoding used for data retrieval + --crawl=CRAWLDEPTH Crawl the website starting from the target URL + --csv-del=CSVDEL Delimiting character used in CSV output (default ",") + --dump-format=DU.. Format of dumped data (CSV (default), HTML or SQLITE) + --eta Display for each output the estimated time of arrival + --flush-session Flush session files for current target + --forms Parse and test forms on target URL + --fresh-queries Ignore query results stored in session file + --hex Use DBMS hex function(s) for data retrieval + --output-dir=ODIR Custom output directory path + --parse-errors Parse and display DBMS error messages from responses + --pivot-column=P.. Pivot column name + --save Save options to a configuration INI file + --scope=SCOPE Regexp to filter targets from provided proxy log + --test-filter=TE.. Select tests by payloads and/or titles (e.g. ROW) + --update Update sqlmap + + Miscellaneous: + -z MNEMONICS Use short mnemonics (e.g. "flu,bat,ban,tec=EU") + --alert=ALERT Run host OS command(s) when SQL injection is found + --answers=ANSWERS Set question answers (e.g. "quit=N,follow=N") + --beep Make a beep sound when SQL injection is found + --check-waf Heuristically check for WAF/IPS/IDS protection + --cleanup Clean up the DBMS from sqlmap specific UDF and tables + --dependencies Check for missing (non-core) sqlmap dependencies + --disable-coloring Disable console output coloring + --gpage=GOOGLEPAGE Use Google dork results from specified page number + --identify-waf Make a through testing for a WAF/IPS/IDS protection + --mobile Imitate smartphone through HTTP User-Agent header + --page-rank Display page rank (PR) for Google dork results + --purge-output Safely remove all content from output directory + --smart Conduct through tests only if positive heuristic(s) + --wizard Simple wizard interface for beginner users + +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/sqlninja.md b/tools/sqlninja.md new file mode 100644 index 0000000..1417870 --- /dev/null +++ b/tools/sqlninja.md @@ -0,0 +1,46 @@ +# sqlninja + +Notes +------- + +Help Text +------- +``` +Sqlninja rel. 0.2.6-r1 +Copyright (C) 2006-2011 icesurfer +Usage: /usr/bin/sqlninja + -m : Required. Available modes are: + t/test - test whether the injection is working + f/fingerprint - fingerprint user, xp_cmdshell and more + b/bruteforce - bruteforce sa account + e/escalation - add user to sysadmin server role + x/resurrectxp - try to recreate xp_cmdshell + u/upload - upload a .scr file + s/dirshell - start a direct shell + k/backscan - look for an open outbound port + r/revshell - start a reverse shell + d/dnstunnel - attempt a dns tunneled shell + i/icmpshell - start a reverse ICMP shell + c/sqlcmd - issue a 'blind' OS command + m/metasploit - wrapper to Metasploit stagers + -f : configuration file (default: sqlninja.conf) + -p : sa password + -w : wordlist to use in bruteforce mode (dictionary method + only) + -g : generate debug script and exit (only valid in upload mode) + -v : verbose output + -d : activate debug + 1 - print each injected command + 2 - print each raw HTTP request + 3 - print each raw HTTP response + all - all of the above + ...see sqlninja-howto.html for details + +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/sqlsus.md b/tools/sqlsus.md new file mode 100644 index 0000000..b9577f1 --- /dev/null +++ b/tools/sqlsus.md @@ -0,0 +1,29 @@ +# sqlsus + +Notes +------- + +Help Text +------- +``` + sqlsus version 0.7.2 + + Copyright (c) 2008-2011 Jérémy Ruffet (sativouf) + +Usage: + sqlsus [options] [config file] + + Options: + -h, --help brief help message + -v, --version version information + -e, --execute execute commands and exit + -g, --genconf generate configuration file + +``` + +Example Usage +------- + +Links +------- + diff --git a/tools/tnscmd10g.md b/tools/tnscmd10g.md new file mode 100644 index 0000000..07343de --- /dev/null +++ b/tools/tnscmd10g.md @@ -0,0 +1,26 @@ +# tnscmd10g + +Notes +------- + +Help Text +------- +``` +usage: /usr/bin/tnscmd10g [command] -h hostname + where 'command' is something like ping, version, status, etc. + (default is ping) + [-p port] - alternate TCP port to use (default is 1521) + [--logfile logfile] - write raw packets to specified logfile + [--indent] - indent & outdent on parens + [--10G] - make it work against 10G + [--rawcmd command] - build your own CONNECT_DATA string + [--cmdsize bytes] - fake TNS command size (reveals packet leakage) + +``` + +Example Usage +------- + +Links +------- + diff --git a/vulnanalysis/index.md b/vulnanalysis/index.md index 618ace1..df664b8 100644 --- a/vulnanalysis/index.md +++ b/vulnanalysis/index.md @@ -18,15 +18,15 @@ Database Assessment * [mdb-export](../tools/mdb-export.md) * [mdb-hexdump](../tools/mdb-dump.md) * [mdb-parsecsv](../tools/mdb-parsecsv.md) - * [mdb-sql](../tools/mdb-sql) - * [mdb-tables](../tools/mdb-tables) - * [oscanner] - * [sidguesser] - * [sqldict] - * [sqlmap] - * [sqlninja] - * [sqlsus] - * [tnscmd10g] + * [mdb-sql](../tools/mdb-sql.md) + * [mdb-tables](../tools/mdb-tables.md) + * [oscanner](../tools/oscanner.md) + * [sidguesser](../tools/sidguess.md) + * [sqldict](../tools/sqldict.md) + * [sqlmap](../tools/sqlmap.md) + * [sqlninja](../tools/sqlninja.md) + * [sqlsus](../tools/sqlsus.md) + * [tnscmd10g](../tools/tnscmd10g.md) Fuzzing Tools -------------