SQL injection is an old technique in which a hacker executes malicious SQL statements to hijack a website. This vulnerability is considered to be of high severity, and the latest report from Acunetix shows that 23% of the scanned target was vulnerable to it.
Since SQL Database (Structured Query Language) is supported by many web platforms (PHP, WordPress, Joomla, etc.), it can target a large number of websites.
Note . Performing SQL injection creates high network bandwidth and sends a lot of data. So, make sure you own the site you are testing.
1.suip.biz
suIP.biz supports MySQL, Oracle, PostgreSQL, Microsoft SQL, IBM DB2, Firebird, Sybase, etc.
SQLMap is included so it will test all six injection methods.
2. SQL Injection Test Online
Another online tool from the creators of Hacker Target based on SQLMap that finds bugs based on a vulnerability against an HTTP GET request.
3. Vega
Vega is a free open source security scanner that is available on Linux, OS X and Windows platforms.
Vega is written in Java and has a graphical interface.
Not only SQLi, but you can use Vega to test many other vulnerabilities such as:
- XML / Shell / URL injection
- Directory List
- Remote file
- XSS
- And much more…
4. SQLMap
SQLMap is one of the popular open source testing tools for injecting SQL into a relational database management system.
Sqlmap handles passwords, hashes, roles, databases, tables, columns and support for full dumping of database tables.
If you are using Kali Linux , then you can use SQLMap without installing it.
5. SQL Injection Scanner
Online scanner from Pentest-Tools using OWASP ZAP. There are two options – lifgt (FREE) and full (registration required).
6. Acunetix
Acunetix is an enterprise vulnerability scanner trusted by over 4,000 brands worldwide. Acunetix is capable of detecting not only SQLi scan but over 6,000 vulnerabilities.
Each detection is categorized with possible fixes, so you know what to do to fix it. In addition, you can integrate with the CI / CD system and SDLC, so every security risk is identified and corrected before the application is deployed to production.
What’s next?
The above tools will test and report if your site has an SQL injection vulnerability. If you are wondering how to protect your site from SQL injection , then the following will give you an idea.
A poorly coded web application is often responsible for SQL injection, so you need to fix the vulnerable code. However, one more thing you can do is implement WAF (Web Application Firewall).