26

I've searched and found a good discussion here on SO, but it is several years old.

What programs are there, or is there a simple script I can run, to find the SQL injection holes in the URLs in my entire site?

Preferably, I'd like to run a script (PHP) or program that crawls my site, bouncing from link to link, attempting to find holes, and upon discovery, stores that URL so I have a list of URLs I need to fix.

Does this exist?

Community
  • 1
  • 1
Luke Shaheen
  • 4,262
  • 12
  • 52
  • 82
  • As long as you use a good library or quote everything, SQL injection is the least of your concerns. I would be more concerned about XSS attacks and network security. – iLLin Mar 13 '12 at 14:38
  • @iLLin I agree, but the problem is that the site is 10 years old and quite large - there are many SQL injection holes that exist from previous years, and I'm looking for a way to easily find them. – Luke Shaheen Mar 13 '12 at 14:41

6 Answers6

17

Yes and no. First i'll preface this by saying I'm not just posting links but have done security audits professionally using all of these tools and not as a developer on a project but an external resource. Note that generally sqlserver injection is different than mysql as well.

Free tools like paros proxy [crawls] (previously mentioned),

burpsuite (previously mentioned [crawls] but active attacks requires pro): http://portswigger.net/burp/

sqlninja (sqlserver only) http://sqlninja.sourceforge.net/

google rat proxy: [crawls] http://code.google.com/p/ratproxy/

websecurify: [crawls] http://www.websecurify.com/

wapiti: [crawls but takes work to set up - can be used specifically for sqli with spider] http://wapiti.sourceforge.net/

nikto: [crawls but not for sqli...]

are great! They can help you identify problems but take a great deal of human analysis due to large amounts of false positives. Commercial tools are available like:

NTOSpider (one of the best [crawls!]) : http://www.ntobjectives.com/software/ntospider

are very expensive but talking to a rep will get you a free copy for a period of time (which I have done with them). They make sorting through results faster by providing validation links in the reports but you STILL need a trained eye and analysis as I have found false positives.

Ultimately the correct answer to this question is: You can use tools to help you identify if there are security (sqli) vulnerabilities but only a trained eye using the tools can validate them. Further only a proper code review and analysis can identify vulnerabilities that an app (even a very good one) may miss.

Tools can help but you need human time and analysis to do this correctly. Proxies and request manglers are the real tools for hitting the app with injection and are done with careful intention of trained testers or those with a curious mind.

JasonG
  • 5,794
  • 4
  • 39
  • 67
9

I have two favorite tools (both free):

  1. sqlmap - You give it a URL, and it automatically scans for vulnerabilities. If it gets in, it gives you a SQL prompt.
  2. Paros Proxy - This one takes a little longer to set up. You have to configure your browser to use a proxy and then use your site (log in, navigate to other pages, etc.). Once you're done, it will analyze its cache of all the requests you made and show a report of the potential vulnerabilities it found.
Zach Rattner
  • 20,745
  • 9
  • 59
  • 82
  • I have sqlmap, but I am looking for something to scan without me giving it a direct URL. Paros Proxy sounds like it could be a good one, although I still have to manually crawl, but at least it's better then manually typing in URLs. – Luke Shaheen Mar 25 '12 at 16:18
4

The Burp Scanner works extremely well for finding SQL injection as well as a variety of other things. You have to shell out $300 for the scanner though, but that is fairly cheap when looking at other scanners in the market.

To elaborate, what you are looking for is a web application vulnerability scanner. These will crawl your site and send attack vectors into various parameters. Of all the scanners that I have used, Burp has given me the best results and has great performance. If you are looking for a free alternative you can try Grendel Scan It has not been updated in a while but still works pretty well. Especially for a free tool.

Here is a list of some the other vulnerability scanners that are out there. I am sure you will find something to meet your needs.

Somnath Muluk
  • 55,015
  • 38
  • 216
  • 226
Drew
  • 171
  • 1
  • 8
  • Burp is pretty nice and it's not limited to just SQL injection you can find out other loopholes that you might not have guessed were there. Bit costly but gets the job done. – Aleks Mar 20 '12 at 09:19
2

There are programs to detect SQL injections, for example:

kenorb
  • 155,785
  • 88
  • 678
  • 743
guybennet
  • 683
  • 1
  • 9
  • 25
2

There are enormous tools present in market for crawling all pages and detecting SQL injections. You should read this discussion it's never late How can I prevent SQL injection in PHP? and Testing for security vulnerabilities in web applications: Best practices?.

I would suggest Wapiti for finding web application vulnerabilities. Acunetix is over priced.

See more:

Community
  • 1
  • 1
Somnath Muluk
  • 55,015
  • 38
  • 216
  • 226
0

What I test in my sites :

If you have log-in form for example try to enter:

username field : anytext or 1=1'

Password field : anypassword

if you didn't cover sql injection in your code , you can login by that .

Thanks

Emad Samir Zaki
  • 393
  • 2
  • 10
  • 2
    Thanks, but not what I'm looking for. I know how to identify SQL injection on a single page - I'm looking for a script to crawl my pages. – Luke Shaheen Mar 13 '12 at 15:03