DataBase Pillager 0.5 Release (Video) Targeted data searches

Updated Link + Features 9/27/2011 after this initial post (New Query-Cmd Line "-q" to drop you into a sql shell and data formatting on display)  
Example: python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor -q

Release 0.6: LINK:Download Pillager 0.6

Been busy as hell lately but I am working on a lot of stuff regarding SQL and Web Hacking stuff I will release soon, but right now I am releasing the newest version of the database pillager. There are numerous new features, optimizations and future development started and some really cool stuff. Currently the newest features include:

New Features:

Database/Table Name targeted searches (done)
Targeted Data searches within columns (done)
Reporting Options (Partially done)
GUI (In development)
Universal SQL CMD shell (Done mysql,mssql)
Also fixing a few more bugs related to mssql and unicode

Video Contents:
The below video will show how to make the most of the tool and show the newest targeted data searches as well as some program structure so you can make some simple modifications.


Untitled from ficti0n on Vimeo.

Commands used:

Simple Pillage:

python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor

Grab Hashes:
python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor --hashes

Database/Table Search based on a list:
python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor -n

Targeted Data Search bases on keyword list:
python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor  -D

Hipaa Search Specifically:
python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor -s hipaa

Limiting data:
python dbpillage.py -a 127.0.0.1 -d mysql -u root -p toor  -s hipaa -l 1

Location of Lists:

inputFiles directory

Burp Intruder Time fields

This is an update from the last video blog: 

I had a update submission from Toxic after watching Web Application video #2. Although module 4 was to learn how to code custom situations... Toxic noted that there are time fields within burp intruder by adding the columns:

-Response Received
-Response Completed

You can get a number related to the seconds it took for the request to complete... For example the php code originally was set for a 2 second sleep function and so Jsmith had the following output:

Response Received: 2107

Now I upped the sleep function to 4 seconds and Jsmith has a new value of:

Response Received: 4001

I then upped the sleep function to 8 seconds and Jsmith has the new value of:
Response Received: 8002

Indicating that field actually does keep track of the time between request and response... Just another option for anyone playing with time based stuff in burp.....

GOOD CATCH TOXIC!!!!!!

Web Hacking Video Series #2 Analysis of application behavior to bypass common implementation issues

.

Video Lesson Topics:  (Running time 50+ minutes)
This lesson covers the following topics:

1. Analysis of application behavior to bypass common implementation issues
2. Writing custom python code to deal with more complex testing situations
3. More on burp suite intruder, comparer and scoping settings
4. Introducing firebug for inspecting page elements
5. Lots of me rambling about testing issues and real world considerations/client issues

New Hacking Lab:  (USE FIREFOX)
 This is my second video on application security which includes a lab of 6 different user enumeration situations. Not really to show user enumeration, but to show the various ways developers handle situations and how we can determine ways to bypass issues. Everyone can follow along and play on the website as I ramble..  I got bored Friday night and started coding, and ended up with the beginning of a mini web hacking lab that I may continue to grow out regarding certain lessons or  I may allow downloading of the whole site when dealing with more dangerous topics I dont want to deploy online.  Also note that I dont care about complying with microsoft internet explorers finicky page parsing issues so use firefox if you dont want viewing issues.  ;)

Web Hacking Video Series #1 Automating SQLi with Burp Extractor

Why:

After speaking with many penetration testers I have realized that web application hacking is a mystery for many testers who typically perform network based penetration testing but have no prior development knowledge. This post is the first in a series of Web Hacking Video Training posts that will attempt to show various techniques that prove useful in situations where you realize all avenues of attack are running across http based protocols. This is typical on external tests.

Immunity Canvas Code and CMDLine Walkthrough

This weekend was my first time playing around with Immunity Canvas. I noticed a lack of documentation for anything Non-Gui based regarding the framework. Since i had such a hard time tracking down information I decided to make a video showing Canvas basic CMDLine usage and tried to explain some module code based on my initial analysis I hope it helps

DbPillage Release 0.3

Database Pillager Release 0.3 
(Couple New features and updates)

Quick announcement on the Database Pillager tool. I have added in new features and updated many things...  Below is some info and an example.

Updated Download Link: (0.6)

http://consolecowboys.org/pillager/pillage_0.6.zip

Updates/Features:
-Grabs database password hashes from each database type when -# or --hashes is used

-Implemented Hipaa Searches for all kinds of data (just searched the web for regexes :) haha if you have more I will be happy to add them)

    * SSN
      SSN with Dashes                 
      SSN with spaces
      ICD10                                        
      Carefirst ID
      dental Procedure
      ICD9/ICD9CMType1
      ICD9/ICD9CMType2     
     

The Database Pillager (tool release)

The Database Pillager
(Usage Tutorial, Tool Release 0.1)

I coded up a Database Pillaging tool for multiple database types which can be downloaded below I would host this tool on some kind of code hosting site but they all seem to be a pain in my ass so it will stay in zip format until I find one that isn't a pain to use or doesn't just display all of my personal data.

UPDATED DOWNLOAD LINK v0.6:  Also updated post for new syntax added new features since htis post but updated the syntax on this post )
http://consolecowboys.org/pillager/pillage_0.6.zip

 

Why?

Since I have yet to find a post exploitation database tool that works well for me, I coded my own. This project was created to solve a reoccurring problem I have had searching and retrieving PCI/HIPPA data after I have compromised the domain or obtained local database credentials and I still need to prove that I have access to sensitive data.  I have found this tool useful for many reasons including finding session tokens, passwords and creditcards in databases. The Database Pillager (DBPillage) was created to fulfill the following goals and is still in active development by myself and other contributors.