Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page.
It can take advantage of a vulnerable web application. By using this software, user can perform back-end database fingerprinting, retrieve DBMS login names and password hashes, dump tables and columns, fetch data from the database, execute SQL statements against the server, and even access the underlying file system and execute operating system shell commands.
The distinctive power of Havij that differentiates it from similar tools lies in its unique methods of injection. The success rate of attack on vulnerable targets using Havij is above 95%.
The user friendly GUI (Graphical User Interface) of Havij and its automated configuration and heuristic detections make it easy to use for everyone even amateurs
What's New?
- Dump all.
- New bypass method for MySQL using parenthesis.
- Write file feature added for MSSQL and MySQL.
- Loading HTML form inputs.
- Saving data in CSV format.
- Advanced evasion tab in the settings.
- Injection tab in settings.
- 'Non-existent injection value' can now be changed by user (the default value is 999999.9).
- 'Comment mark' can be changed by user (the default value is --).
- Disabling/enabling of logging.
- Bugfix: adding manual database in tables tree view.
- Bugfix: finding string columns in PostgreSQL.
- Bugfix: MS Access blind string type data extraction
- Bugfix: MSSQL blind auto detection when error-based method fails
- Bugfix: all database blind methods fail on retry
- Bugfix: guessing columns/tables in MySQL time-based injection
- Bugfix: crashing when dumping into file
- Bugfix: loading project injection type (Integer or String)
- Bugfix: HTTPS multi-threading bug
- Bugfix: command execution in MSSQL 2005