Hi, We are glad to release sqlmap version 0.9. Introduction ============ sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections. Changes ======= Some of the new features include: * Rewritten SQL injection detection engine (Bernardo and Miroslav). * Support to directly connect to the database without passing via a SQL injection, -d switch (Bernardo and Miroslav). * Added full support for both time-based blind SQL injection and error-based SQL injection techniques (Bernardo and Miroslav). * Implemented support for SQLite 2 and 3 (Bernardo and Miroslav). * Implemented support for Firebird (Bernardo and Miroslav). * Implemented support for Microsoft Access, Sybase and SAP MaxDB (Miroslav). * Added support to tamper injection data with --tamper switch (Bernardo and Miroslav). * Added automatic recognition of password hashes format and support to crack them with a dictionary-based attack (Miroslav). * Added support to fetch unicode data (Bernardo and Miroslav). * Added support to use persistent HTTP(s) connection for speed improvement, --keep-alive switch (Miroslav). * Implemented several optimization switches to speed up the exploitation of SQL injections (Bernardo and Miroslav). * Support to parse and test forms on target url, --forms switch (Bernardo and Miroslav). * Added switches to brute-force tables names and columns names with a dictionary attack, --common-tables and --common-columns. Useful for instance when system table 'information_schema' is not available on MySQL (Miroslav). Complete list of changes at https://svn.sqlmap.org/sqlmap/trunk/sqlmap/doc/ChangeLog. Download ======== You can download it in two formats: * Source gzip compressed, http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.tar.gz * Source zip compressed, http://downloads.sourceforge.net/sqlmap/sqlmap-0.9.zip Documentation ============= * sqlmap user's manual: http://sqlmap.sourceforge.net/doc/README.pdf * Conferences' material (whitepaper and slides): http://sqlmap.sourceforge.net/#docs Contribute ========== We are looking for people who can write some clean Python code, are up to do security research, know about web application security, database assessment and takeover, software refactoring and are motivated to join the development team. If this sounds interesting to you, get in touch! For the sceptical.. No, it's not only about web application. Yes, it helps you also to get a command prompt on the target system. Yes, it can be used to privilege escalate to SYSTEM if the target system is Windows. Not yet convinced that this tool is worth a try? Get some popcorns, head to http://www.youtube.com/user/inquisb#g/u and watch some video demonstrations. Happy hacking! -- Miroslav Stampar E-mail: miroslav.stampar (at) gmail.com PGP Key ID: 0xB5397B1B ------------------------------------------------------------------------ This list is sponsored by: Information Assurance Certification Review Board Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. http://www.iacertification.org ------------------------------------------------------------------------