SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 269
˛˛ SQLBrute is the tool for command-line users who have a fixed vulnerability they
wish to exploit using either time- or response-based inference.
˛˛ Sqlninja, among a number of features, supports a DNS-based alternative channel for
remote command execution that works by first uploading a custom binary wrapper
and then executing the command via the uploaded wrapper. The wrapper captures
all output from the command and initiates a sequence of DNS requests containing
the encoded output.
˛˛ Squeeza takes a different look at SQL injection, splitting data creation from data
extraction. This command-line tool can extract time through time-based inference,
classic errors, or DNS. The DNS channel is performed entirely through T-SQL, and
thus does not require an uploaded binary.