bugtraq - RE: Yet another SQL injection framework

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <C41BC025DD4FFC4586B2FB54AFCC3FBD0247F8@c2exfenj.uclnj.com>
Date: Mon, 23 Apr 2007 16:03:39 -0400
From: "Greg Merideth" <gmerideth@...nj.com>
To: "Nick Boyce" <nick.boyce@...il.com>, <bugtraq@...urityfocus.com>
Subject: RE: Yet another SQL injection framework

The script simply hides or shows the link on the page which points to
sf.

http://sourceforge.net/projects/injection-fwk/

-----Original Message-----
From: Nick Boyce [mailto:nick.boyce@...il.com] 
Sent: Friday, April 20, 2007 9:13 AM
To: bugtraq@...urityfocus.com
Cc: Guillermo Marro
Subject: Re: Yet another SQL injection framework

On 4/19/07, Guillermo Marro <gmmarro@...wgate.net> wrote:

> FG-Injector is a free tool that leverages the pentester's work by
> facilitating the exploitation of SQL Injection vulnerabilities.
[...]
> Get both, sources and a windows binary from:
> http://www.flowgate.net/?lang=en&seccion=herramientas

Um .. when I click on the link for "FG-Injector" at the above site
with my NoScript-enabled Firefox all I see is what looks like a server
log entry for my interaction :

aaa.bbb.ccc.ddd Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.1.3) Gecko/20070309 Firefox/2.0.0.3 /injector

This is presumably because the actual links are infested with Javascript
:

onClick="javascript:showStaff('injector')"

Since I'm following links in an email on a security mailing list I'm
disinclined to disable NoScript - any chance you can convert the links
into normal HREFs ?

I could go and grab your Javascript library and figure out what
'showStaff' does ... but I'd rather just click on an old-school link.

Cheers
Nick Boyce
-- 
I speak to all bloggers everywhere: just shut up for a second and let
me think, will you?
 -- blog comment at http://it-gears.blogspot.com/   :-)