March 28, Dark Reading – (International) Cybercriminals’ love affair with Havij spells SQL injection trouble. Today’s exponential increase in attack volume and complexity can largely be attributed to cybercriminal working smarter with powerful, automated tools. In the database-cracking world, Havij stands as one of the most popular of these tools: and as such, it should be on the radar of any security professional seeking to prevent costly data breaches within their environments. “If you’re talking about databases and the tools that are used to perform SQL injection, Havij is one of the most common,” a senior security strategist at Imperva said. Havij was developed by Iranian hackers in the spring of 2010. The tool has so captured the hearts and minds of the black hat community, that groups like Anonymous frequently train on how to wreak havoc using it, said the chief technology officer at Application Security, Inc. Favored by hacktivists and financially motivated attackers, Havij automates criminals’ SQL injection attacks by automatically detecting the database behind a targeted Web site, detecting whether it uses a string or integer parameter type, and testing different injection syntaxes. Unlike a lot of penetration tools, Havij can not only point to potential vulnerabilities, it can also carry out data extraction and harvesting.
Source: http://www.darkreading.com/databasesecurity/167901020/security/news/232700449/cybercriminals-love-affair-with-havijspells-sql-injection-trouble.html
