Thanks to KJo for pointing this out to us. So, why is it important? Well, SQLmap is an awesome tool, but it takes some understanding to figure out all of your command line options. However 0.9 now has a command line driven WIZARD, that makes getting your feet wet much easier. I plan to check this out on some of my upcoming assessments.

We also thought it would be fun to go over some of the features that simply rock about this tool.

First is the support for blind, time-based and error based SQL injection. There are so few tools that get any one of these right, it is cool that it covers all three.

The second thing we like about this tool is that it kicks the ass of many of the commercial vendors when it comes to SQL injection capabilities. Because, you know, it is free. And, free is good.

I also like how it can parse targets from a Burp requests log file. Seriously, we have a perverse kind of love for Burp. It is kind of cool that now I can integrate two of my all-time favorite web testing tools.

Also, is supports user-agents. I know this seems boring to a number of you, but think of it like this; does the site you are testing have the same security features for an iphone accessing the site as a normal web browser session?

Finally, it integrates with Metasploit. Seriously, this is awesome.

So, congratulations to the SQLMap team on a job well done.

Larry and John Strand

Originally discussed during episode 239

John Strand will be teaching Hacker Techniques and Incident Response June 25th-30th in Denver Colorado. This time he will do his best to not get kicked out of the hotel....