sqlninja

sqlninja is designed to exploit SQL injection vulnerabilities specifically on Microsoft SQL Server, transforming them into full system compromise. Starting from a SQL injection point, it disables Data Execution Prevention via registry shots, generates debug scripts automatically, and wraps attacks with Metasploit for reliable payload delivery.

Use cases include testing MSSQL web applications for injection flaws, bruteforcing sa accounts, privilege escalation, uploading backdoors, establishing shells (direct, reverse, ICMP, DNS-tunneled), and launching Metasploit stagers. It supports comprehensive attack chains from fingerprinting to post-exploitation.

The tool requires a configuration file detailing the target and injection points, with modes handling different exploitation phases. Debug output and verbose logging aid in troubleshooting injection issues.

sqlninja operates by injecting SQL payloads tailored for MSSQL, confirming vulnerabilities with techniques like 'waitfor delay'. It fingerprints the server, user privileges, and xp_cmdshell availability, then executes mode-specific attacks: bruteforcing sa passwords, escalating privileges by adding users to sysadmin roles, resurrecting xp_cmdshell, uploading .scr files via debug scripts, scanning for outbound ports, establishing shells over HTTP/DNS/ICMP, issuing blind OS commands, or integrating with Metasploit. All interactions use HTTP requests with configurable injection strings from sqlninja.conf.