Security Dashboard
Wednesday 3 September 2008 - 371 read - ( Keywords : Application Scanner , Configurations checks , SQLmap , Vulnerability Scanner )
SQLmap is an automatic SQL injection tool entirely developed in Python. It is capable to perform an extensive database management system back-end fingerprint, retrieve remote DBMS databases, usernames, tables, columns, enumerate entire DBMS, read system files and much more taking advantage of web application programming security flaws that lead to SQL injection vulnerabilities.Changelog for this release :
Added multithreading support to set the maximum number of concurrent HTTP requests.
Implemented SQL shell (—sql-shell) functionality and fixed SQL query
(—sql-query, before called -e) to be able to run whatever SELECT
statement and get its output in both inband and blind SQL injection attack.
Added an option (—privileges) to retrieve DBMS users privileges, it
also notifies if the user is a DBMS administrator.
Added support (-c) to read options from configuration file, an example
of valid INI file is sqlmap.conf and support (—save) to save command
line options on a configuration file.
Implemented support for HTTPS requests over HTTP(S) proxy.
Enhanced logging system: added three more levels of verbosity to show also HTTP sent and received traffic.
POSTSCRIPTUM
COMPLIANCE MANDATES
Application Scanner : PCI/DSS 6.3, SOX A12.4, GLBA 16 CFR 314.4(b) and (2), HIPAA 164.308(a)(1)(i), FISMA RA-5, SA-11, SI-2, ISO 27001/27002 12.6, 15.2.2Vulnerability Scanner : PCI DSS 11.2, 6.6, SOX A13.3, GLBA 16CFR Part 314.4(c), HIPAA 164.308(a)(8), FISMA RA-5, SI-2, ISO 27001-27002 12.6, 15.2.2RELATED ARTICLES
Application Scanner,
Configurations checks,
SQLmap,
Vulnerability Scanner,
15 March 2010 : SQLMap v0.8 released19 January 2010 : (Info) SQLmap v0.8 stable soon to be released10 October 2009 : SQLMap v0.8 release candidate 1 is out28 July 2009 : SQLmap version 0.7 in the wild24 April 2009 : SQLMap 0.7rc1 available
