Havij

Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.�It can take advantage of a vulnerable web application. By using this software, user can perform back-end database fingerprinting, retrieve DBMS login names and password hashes, dump tables and columns, fetch data from the database, execute SQL statements against the server, and even access the underlying file system and execute operating system shell commands.

-----------------------------------------------------------------------

Created by: Davit Mikaelyan
Reviewed by: Vladimir Soghoyan
Ogma Applications

1. Created by: Davit Mikaelyan Reviewed by: Vladimir Soghoyan Ogma Applications Havij Advanced SQL Injection Tool

2. Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page. It can take advantage of a vulnerable web application. By using this software, user can perform back-end database fingerprinting, retrieve DBMS login names and password hashes, dump tables and columns, fetch data from the database, execute SQL statements against the server, and even access the underlying file system and execute operating system shell commands. 02/4/2014 Ogma Applications 2 About Havij

3. Downloading Application 02/4/2014 Ogma Applications 3 First of all it is necessary to download and install application. The download link is below: http://itsecteam.com/products/havij-advanced-sql-injection/

4. Finding vulnerable sites 02/4/2014 Ogma Applications 4 To find vulnerable sites we can use “Google dork”. Navigate to http://freetexthost.com/paz14e6za6 and choose one of dork, f.e . “ productDetails.php?id =“. Insert chosen dork into Google.

5. Finding Vulnerable S ites 02/4/2014 Ogma Applications 5 Randomly open sites to test them for vulnerability. For testing site insert into URL ‘ symbol, for example http://www.site.com/productDetails.php?id=10 . Insert ‘ between “=” and “10” like this http://www.site.com/productDetails.php?id=‘10

6. If we get error in loading page then the site is vulnerable And if the page is loading normally then the site is not vulnerable. 02/4/2014 Ogma Applications 6 Finding vulnerable sites

7. Using Havij 02/4/2014 Ogma Applications 7 Put vulnerable site URL without ‘ symbol into “Target” field and press on “Analyze” button.

8. Using Havij Havij analyzing target After analyzing ,click on “Tables” ->”Get Tables” for getting site database tables. 02/4/2014 Ogma Applications 8

9. Using Havij Select a table and press on “Get Columns” button. Select columns and press on press “Get Data” button 02/4/2014 Ogma Applications 9

10. So, with help of Havaji we could get site database information including site admin login and password 02/4/2014 Ogma Applications 10 Havaji Summary