Re: Scanning for SQL Injection

["rajat swarup" <rajats@gmail.com>]

> -----Original Message-----
> From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
> Behalf Of Ron Johnson - Adhost
> Sent: Thursday, June 28, 2007 11:07 PM
> To: pen-test@securityfocus.com
> Cc: listbounce@securityfocus.com
> Subject: Scanning for SQL Injection
>
> Hi. I need to scan about 350+ sites from three different web servers that
> all connect to one MS SQL server for SQL injection. Any ideas on how to make
> this not take a long long time?
>
> I like the Priamos tool but you can only scan one site at a time, and you
> can't load a list of any sort, etc.
>
> Any input is appreciated
Hi,
Paros spider + scanner should be able to do stuff without much
intervention.  However, Paros will need a starting seed URL list.  I'd
suggest write up a script in curl that loops through all the sites
using paros as a local proxy.  This would give the seeds to Paros.
Once that is done, spider all URLs and then scan them.

HTH,
Rajat Swarup.

http://rajatswarup.blogspot.com/

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Swap Out your SPI or Watchfire app sec solution for
Cenzic's robust, accurate risk assessment and management
solution FREE - limited Time Offer

http://www.cenzic.com/wf-spi
------------------------------------------------------------------------