<Future> jSQL version 0.3

[ron...@ymail.com]

Next release includes:
- distant file reading [sqli],
- config saving [gui],
- user interface tweaks [gui] -- context menus copy/cut/paste/select all, shortcuts Ctrl+z/Ctrl+y/Ctrl+s, menubar, about/preference windows, etc
- data saving [gui] -- tab separated values for tables, text for files

The engine I used for a whole table inspection works as well for a file, so it wasn't much work to add it.

If you are a website administrator, file reading shouldn't bother you very much because the default user logged into the database must have the FILE privilege, which is disabled most of the time. But you may test it with no harm in your LAMP/WAMP as a PoC. Also this threat should stay asleep as long as no db user is granted FILE, and/or if the default user does not change for another one who does have FILE grantee... so I may work on distant table update next and also distant file write, if only I find enough documentary ressources on that stuff ; apparently there's no stack query therefore I wonder if table update is doable ; I looked at file write in the past but couldn't figure how to deal with it (first if it works, then what you do next if it works - mainly reverse tcp?).
Technically you are blind (again), you don't know what file is at reach, you have no file name and no path. But first you can try system files ; /etc/mysql/my.cnf, C:/Windows/system.ini, /etc/hosts, C:/Windows/System32/drivers/etc/hosts. Furthermore other tools like spiders can retreive a complete path and file name for you, jSQL won't, nevertheless it will read it if the path+filename are corrects.

Also I did take a break for some weeks until now, but I thought recently that this read-a-file thing may integrate nicely, so voila :)
And I always need materials and new ideas to keep this project alive, so stay in touch and bring food at the picnic :) !

I will clean the code for now (take a break, have exams) and release the v0.3 soon.

[ron...@ymail.com]

jSQL Injection v0.3 changes:
+ distant file reading [sqli]
+ webshell deposit [sqli]
+ terminal to run webshell commands [gui]
+ configuration backup [gui]
+ Updates checking [gui]
+ user interface tweaks [gui]

Download the application on the Downloads page.

- I used VirtualBox to confirm that application runs also on Linux (Ubuntu) (² and Mac OS X), it allowed me to fix a behavior problem on JTree mouse click when using Linux. I will add screenshot for those two OS's on the website.
- I added some tooltips on important Components like tab headers, suggest better wording if necessary.
- JTree works strangely when using a Component in a JPanel as a node and I suppose it's this problem that breaks the loader animation sometimes. The problem is described on http://stackoverflow.com/q/14886300 and http://stackoverflow.com/q/9604095.
- MySQL variables like @@version_compile_os, @@hostname or @@version aren't in jSQL still, I may add a tab for reading them in next releases.
- Webshell page is currently lazily named test_outfile.php and contains the PHP code <?php system($_GET['c']); ?>, I could make the name unique like yyyymmddhhmmss.php and use crazy zipped encryption to shadow the file, I will see if it's really needed.
- I need help to add some more default paths to File and Webshell tab, you can leave a message and propose other paths frequently used by webmasters and pentesters.
- I can add an information tab to render the current HTML webpage being processed, it can give information on what is happening on server and client side.
- Now you can check if a new version has been released directly from the tool.

Next work:
+ distant table writing [sqli]
+ distant file writing [sqli]
+ reverse tcp shell deposit [sqli]
+ right elevation [sqli]
+ speed increase (non encoding pass): 50% faster [sqli]
+ control all running tasks in a tab [gui]
# speed test comparison with other injection tools [dev]
# automatic code testing (JUnit) [dev]
# wiki pages [site]

[ron...@ymail.com]

From the About panel:

Support the development of jSQL, you can do any (or all) of the following:
- Star the project homepage or the download page (the star is displayed if you have previously logged in your Google account),
- Click the +1 on the project homepage or on the group page,
- Become a member of the jSQL group,
- Post a comment in the discussion group or by email,
- Spread the word.

Stay informed about jSQL updates, subscribe to RSS feeds for new releases and source changes.