SQL Injection Google Scanner

I’ve just found a nice python script of SQL Injection Google Scanner from here. It’s not just a single host SQL Injection Scanner , but its task is to collect hosts that vulnerable to SQL Injection by running Google search query. If you’re already familiar with Remote File Inclusion Scanner by Morgan , then you should be familiar with this one , too.

usage :

python SQLscan.py -g inurl:’.gov’ 200 -s ‘/index.php?offset=-1/**/UNION/**/SELECT/**/1,2,concat(password)/**/FROM/**/TABLE/*’ -write sql_found.txt -v

It will scan for any site that contains ‘.gov’ in its URLs , and then they’ll be checked by inject a SQL Injection String (you could modify the strings as creative as you can be) , and make sure that your box is installed with python 1st .

To download the script , i’ve made a mirror of it , which is located here :

http://4r13-is-a.lamer.la/scrapts/SQLscan.py

Related Posts

• Technika Security Framework , Hackbar 1.1.1 : Mozilla Firefox Plugins for hacking purposes
• Web Based XSS / HTML Injection Scanner
• Burp - XSS Discovery Tool #1
• Beginner’s Guide to SQL INJECTION VIDEO PODCAST
• Wordpress wp-login.php Brute Force password Cracking Python Exploit