Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.
It can take advantage of a vulnerable web application. By using this software user can perform back-end database fingerprint, retrieve DBMS users and password hashes, dump tables and columns, fetching data from the database, running SQL statements and even accessing the underlying file system and executing commands on the operating system.
The power of Havij that makes it different from similar tools is its injection methods. The success rate is more than 95% at injectiong vulnerable targets using Havij.
The user friendly GUI (Graphical User Interface) of Havij and automated settings and detections makes it easy to use for everyone even amateur users.
Features:
1. Supported Databases with injection methods:
1. MsSQL 2000/2005 with error
2. MsSQL 2000/2005 no error (union based)
3. MySQL (union based)
4. MySQL Blind
5. MySQL error based
6. Oracle (union based)
7. MsAccess (union based)
2.Automatic database detection
3.Automatic type detection (string or integer)
4.Automatic keyword detection (finding difference between the positive and negative response)
5.Trying different injection syntaxes
6.Proxy support
7.Real time result
8.Options for replacing space by /**/,+,... against IDS or filters
9.Avoid using strings (magic_quotes similar filters bypass)
10.Bypassing illegal union
11.Full customizable http headers (like referer and user agent)
12.Load cookie from site for authentication
13.Guessing tables and columns in mysql<5 (also in blind) and MsAccess
14.Fast getting tables and columns for mysql
15.Multi thread Admin page finder
16.Multi thread Online MD5 cracker
17.Getting DBMS Informations
18.Getting tables, columns and data
19.Command executation (mssql only)
20.Reading system files (mysql only)
21.insert/update/delete data
0 comments