Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 02 Jun 2008 14:17:25 +0200
From: MARE system Security <>
Subject: SQL_injection detection tool released

We just released a tool to check for (well known)
sql_injections on a file-basis. 
Due to the mass-hacks during the last months we just
wanted to know if probably our webservers got
hacked through sql_injections (although reports mostly 
speak about MSSQL/ASP), so this check is based
upon a regex for /[a-zA-Z0-9].js but might
be extended via words-lists


We'd like to discuss file-based scanning vs remote-scanning 
via htdig or other web-crawlers, since we do that too with our

from the README:

check_websites is a program to basically
check a webser_document_root, webserver_logfiles
and sql_dumps against possible hackings. so it does not
prevent you from creating safe code (see links), but if
you are an administrator of a web/applicationserver 
you might want to know if some of your customers
have  already_hacked applications running, spreading
virsues and exploits all over the planet. this suite will not
protect your webserver but you might be able to check
if you already have been attacked and hacked. 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.