squeeza: making your injections count

Can I get an introduction?

Sure. squeeza was released as part of SensePost's BlackHat USA 2007 talk on timing and related attacks.

A local copy of the paper is available, as is a copy of the slides.

squeeza is a tool that helps exploit SQL injection vulnerabilities in broken web applications. Its functionality is split into creating data on the database (by executing commands, copying in files, issuing new SQL queries) and extracting that data through various channels (dns, timing, http error messages)

Currently, it supports the following databases:

• Microsoft SQL Server

squeeza is *not* a tool for *finding* injection points. That recipe generally starts with 1 x analyst.

squeeza is distributed under the GNU General Public License.

Check out the README.

| Contact the SensePost Team | Return to the full research listing |

	Subscribe to SensePostResearch
	Email:
	Browse Archives at groups.google.co.za