This tool is one of the best SQL-i tools, jsql-injection is java application with grapical user interface to perform automatic SQL injection. If you are a people who running windows computer, don’t worry because this tool is cross platform and also can run correcly on windows computer.
jSQL Injection is a Java application for automatic SQL database injection with multiple injection strategies and also inject webshell and also lightweight application used to find database information from a distant server.
It is free, open source and cross-platform (Windows, Linux, Mac OS X).
jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in other distributions like Pentest Box, Parrot Security OS, ArchStrike or BlackArch Linux.
- Automatic injection of 23 kinds of databases: Access, CockroachDB, CUBRID, DB2, Derby, Firebird, H2, Hana, HSQLDB, Informix, Ingres, MaxDB, Mckoi, MySQL, Neo4j, NuoDB, Oracle, PostgreSQL, SQLite, SQL Server, Sybase, Teradata and Vertica
- Multiple injection strategies: Normal, Error, Blind and Time
- Multiple injection structures: Standard, Zipped, Dump In One Shot
- SQL Engine to study and optimize SQL expressions
- Injection of multiple targets
- Search for administration pages
- Creation and vizualisation of Web shell and SQL shell
- Read and write files on host using injection
- Bruteforce of password’s hash
- Encode and decode a string
Install Java 8, then download the latest release and double-click on the file
jsql-injection-v0.81.jar to launch the software.
You can also type
java -jar jsql-injection-v0.81.jar in your terminal to start the program.
If you are using Kali Linux then get the latest release using command
sudo apt-get -f install jsql, or make a system full upgrade with
apt update then
Use the sample scripts to test injection on your local environment. First install a development environment like EasyPHP, then download the test-bed PHP scripts and place them into
<?php # http://127.0.0.1/mysql/strategy/get-normal.php?id=0 $link = mysqli_connect('localhost', 'root', '', 'my_database'); $result = $link->query("SELECT col1, col2 FROM my_table where id=$_GET[id]"); while ($row = $result->fetch_array($result, MYSQLI_NUM)) echo join(',', $row);
Screenshots and [video]
Burp integration, Crawler, Database: Netezza, Full Path Disclosure, Injection strategies: DIOS RoutedQuery OOB, Dictionnary attack, WAF detection.
Since latest release
Test-bed scripts for php5 and php7 shared on Github, SOAP injection, Fix multi-params injection, Fix adding items to Scan list, Fix translation dialog
Test all parameters including JSON, Parse forms and Csrf tokens, Databases: CockroachDB Mckoi Neo4j NuoDB Hana and Vertica, Translation complete: Russian, Chinese
Error Strategies for MySQL and PostgreSQL compatible with Order/Group By, Wider range of Characters Insertion including multibyte %bf
SQL Engine, MySQL Error strategy: DOUBLE, Translations: es pt de it nl id, 18 Database flavors including Access
Translation: cz, 17 Database flavors including SQLite
URI injection point, Source code mavenification, Upgrade to Java 7
Authentication: Basic Digest Negotiate NTLM and Kerberos, Database flavor selection
Scan multiple URLs, Github Issue reporter, 16 Database flavors including Cubrid Derby H2 HSQLDB MariaDB and Teradata
Speed x2: No more hex encoding, 10 Database flavors including MySQL Oracle SQLServer PostgreSQL DB2 Firebird Informix Ingres MaxDb and Sybase, JUnit tests, Log4j, GUI translation
SQL Shell, File Uploader
Admin page finder, Bruteforce hashes like MD5 and MySQL, Encode and decode string with methods like Base64, Hex and MD5
File injection, Web Shell with integrated CLI, Persistence of application parameters, Update checker
Strategy Time, Multi-thread control: Start Pause Resume and Stop, Log URL calls
Method GET POST Header and Cookie, Strategies Normal Error and Blind, Best strategy selection, Progression bars, Simple evasion, Proxy settings, MySQL only
Attacking web-server is illegal without prior mutual consent. The end user is responsible and obeys all applicable laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.