Fedora Project Drops SQLNinja 'Hacker' Tool 159
simonb writes, "In what can only be described as a fit of insanity, the Fedora Board have declared a 'hacker tool' not fit for entry into their software repositories. Today your SQL injection tools, tomorrow your nmap?" The Register links the Fedora board's meeting minutes. From the story: "The move came on Monday in a unanimous vote by the Fedora Project's board of directors rejecting a request that SQLNinja be added to the archive of open-source applications. It came even as a long list of other hacker tools are included in the bundle and was harshly criticized by some security watchers. 'It seems incredibly short sighted to reject software based on perceived legal usage,' said Jacob Appelbaum, a full-time programmer for the Tor Project. 'They have decided to become judges of likely usage based on their own experience. That is a path of madness.' ... [T]he board unanimously decided to add a new statement to Fedora's legal guidelines concerning the inclusion of hacking tools. ... Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks."
Because it's impossible to install from sources (Score:3, Insightful)
Oh wait.
Who cares if X or Y is left out of a distro? If it's available, it's installable.
Re: (Score:2)
I find that the natural ultimate Pentool Linux Distro is clearly Backtrack.
That said, often fedora and Ubuntu 10 will act a lot friendlier in a live cd (or usb) format.
Thus my pentest drive contains bootable versions of all 3. Looks like that might be changing.......
Re: (Score:2)
Re: (Score:2)
> Who cares if X or Y is left out of a distro? If it's available, it's installable.
Yes, the distro compilers could make their ISOs much quicker to download if they omitted X and Gnome. After all, they're available in source format for later download and compilation.
And as for Open Office, well that'll only take 6 hours to compile...
The *point* of a distro is to provide a convenient, tested, coherent system.
Re: (Score:2)
Ok look. There are two c files that include windows.h Wonder why fedora would care about them...??? It's a couple of crap MSVC console applications. They even give you .exe files in the archive. Might even work in Wine. No compiling necessary, unless you want to port it yourself (Which you don't because you clearly have no clue how to create a make file for yourself).
What else... Oh shit! There's a Perl file there too. Maybe Fedora would be interested in that? (BTW, here's your next clue. You don't
Re: (Score:2)
I'm not interested in Fedora, nor was I previously aware of how sqlninja was created.
Not everyone is a programmer, but you don't need to be to run commands like "make".
Re: (Score:2)
You don't have to be a programmer to do the following either:
If you have issues with any of the above, you probably shouldn't be running the software anyway. If you can't spot the only file with unix execute permissions named "sqlninja" and another file called "sqlninja-howto.html" then you don't need this software. It doesn't matter if it comes in an RPM or not at that point.
Again, I'll ask. Why would a Linux distribution care about a tool that i
Re: (Score:2)
Go to my first comment in this thread. (:
Re: (Score:2)
Re: (Score:2)
guess that makes sense.
I never claimed anyone had to be programmer, just curious as to how you're supposed to build from source. I didn't realize the "source" distribution included a perl file, amongst other things. Just shows I'm unfamiliar with the package.
Re: (Score:2)
I wish you hadn't cursed so much, but you are absolutely right in your analysis.
As the old linux community saying goes... (Score:5, Insightful)
If you don't like the way we do it, do it yourself.
Isn't that kind of the point of things being open? That you don't have to agree with the way things are done -- you have the source, change/fix/fork it yourself.
In other words -- non-story. Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.
Re: (Score:3, Informative)
might get flamed for this but this is exactly why I love running gentoo. Sources are mostly widely available, if for some reason emerge is throwing a fit about masked packages. Anyways from TFA:
'Argument for SQLninja to be added to Fedora is that it is a 'penetration testing tool.'
I still do not quite understand the grounds here. Honestly, nmap, wireshark, and tcpdump are just a few tools also 'freely' available that do similar things on a different level. Whatever the fedora board is smoking I want some.
Re:As the old linux community saying goes... (Score:5, Interesting)
The flip side of the coin though is that nmap, wireshark, and tcpdump all have uses beyond pen-testing or hacking. nmap can be used to help diagnose routing issues (I've actually used it for that), as well as for veryifying your network map, and other similar uses.
Wireshark is similarly very useful for debugging. For example, it can quickly help you determine that your software is creating malformed packets, or determine exactly what order your packets are being sent, or exactly what they contain. tcpdump is similar.
Even password cracking tools like jack the ripper can be used for purposes other than hacking or pen-testing. One possible such use (despite being a bit questionable) is ensuring minimum password strength, by running it for a fixed amount of time, and rejecting any passwords it can crack in that timeframe.
The difference is that sqlninja really has no use beyond hacking or pen-testing. It does not even pretend it might have other uses.
That all said, I'm not saying that refusing to package it is the right course of action. Indeed that seems questionable at best. I'm merely pointing out how sqlninja is different from the other tools you mentioned.
Re: (Score:3, Informative)
> nmap can be used to help diagnose routing issues (I've actually used it for that)
If you use nmap to diagnose routing, you are doing something wrong. Heard of mtr and looking glasses?
> Wireshark is similarly very useful for debugging. For example, it can quickly help you determine that your software is creating malformed packets, or determine exactly what order your packets are being sent, or exactly what they contain. tcpdump is similar.
As both use libpcap, they would be.
> Even password cracking
Re: (Score:2)
If you use nmap to diagnose routing, you are doing something wrong. Heard of mtr and looking glasses?
Looking glasses are very useful. MTR is also a prefered tool. But nmap does have a few good tricks up its sleeve. As the name suggests, it can help with mapping out networks, which unfortunately is often necessarily when diagnosing routing issues through an unfamiliar public network. After all, many networks don't provide looking glass services, or other ways of getting much information about the network map.
> Wireshark is similarly very useful for debugging. For example, it can quickly help you determine that your software is creating malformed packets, or determine exactly what order your packets are being sent, or exactly what they contain. tcpdump is similar.
As both use libpcap, they would be.
I would certainly hope so, I mean pretty much all packet sniffers seem to be based on libpcap. Of co
Re: (Score:2)
> I think you meant renaming KTron to KSnakeDuel.
http://old.nabble.com/RFC:-Rename-KBattleShip-and-KTron-td27280141.html [nabble.com]
A case for password crackers (Score:2)
I have a friend who works as a computer techie at a school. In most cases, if you were to ask a teacher what type of computer they had, they would answer "a white one".
What he often finds is that when a teacher wants something fixed (read: they somehow found their way to the control panel and messed something up, or want something installed) on their laptop, they give it to him and then leave withou
Re: (Score:2)
Fair enough. I most certainly have used LiveCDs to bypass password checks. The case of this specific tool has fewer indisputably acceptable non-(pen-test) use cases.
For example, while it could be used to penetrate a rouge MS SQL Server install in your network, you can disconnect the device forcibly (if it is not one of yours), or physically go to the device, and kill the server. MS SQL Server is not protected against access by the admins of the machine it is running on.
In the end nobody is really harmed by
Re: (Score:2, Insightful)
As a white hat developer, I've found tools such as nmap, wireshark and tcpdump useful in my daily life. While I can see that this tool can be used by security researchers, I cannot imagine a scenario where I would use a tool such as this one. Forget about the security objections of Fedora. On its own, this tool is a highly specialized utility. It is not something the everyday user or developer really needs.
Re: (Score:2)
Penetration testing should be part of the regular testing process. We would see fewer hacked stuff.
Re: (Score:3, Insightful)
Re: (Score:1, Insightful)
Then the question becomes: "Why use a distribution at all? Why not compile everything from scratch?"
The answer is: convenience.
Leaving out any useful tool is just stupid. If you want to leave out the slirp package, that's understandable. People actually use this tool though.
where's their own RPM file? (Score:3, Informative)
Re: (Score:2, Insightful)
Because _distributing_ Free software is the distribution's job. The developers should only make the source available and let any distros that want it package it themselves.
I believe they just said they don't want it.
Even if it wasnt open (Score:2)
There is no reason you cant get it elsewhere and install it yourself on Fedora. That works for windows folks..
( now if RedHat started blocking or reporting installs of stuff they don't like THEN there would be a problem )
Re: (Score:3, Insightful)
If you don't like the way we do it, do it yourself.
Isn't that kind of the point of things being open? That you don't have to agree with the way things are done -- you have the source, change/fix/fork it yourself.
In other words -- non-story. Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.
True. The net effect of the Board's decision, so far as people actually using said tool, will be nil. My guess is that this is some kind of "cover their collective asses" move, over perceived liability for distributing such software. Given the current legal climate in many countries towards "hacking" tools (doesn't Germany take a rather hard line there?) they may actually have a legitimate concern. I don't know, not a lawyer, etc. etc.
Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.
There really should be no "stance", in that sense. They're blaming the to
Re:As the old linux community saying goes... (Score:4, Informative)
Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.....If a piece of software can be used to test a network for vulnerability, it can likely be used to penetrate said network.
This software does not secure or test anything. It's used to a exploit SQL injection vulnerability found by other means. Go read its sourceforge page which says.
There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network
Re: (Score:2)
Smith said the language is intended to clarify its stance on a class of software that can be used both to secure and penetrate protected networks.....If a piece of software can be used to test a network for vulnerability, it can likely be used to penetrate said network.
This software does not secure or test anything. It's used to a exploit SQL injection vulnerability found by other means. Go read its sourceforge page which says.
There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network
I'm afraid that I don't understand your point. Are you saying that, because this isn't a program that just goes "oh look, I think I found a vulnerability" but actually exploits it, that it's any less valuable to someone in charge of network security?
Re:As the old linux community saying goes... (Score:5, Informative)
I'm afraid that I don't understand your point. Are you saying that, because this isn't a program that just goes "oh look, I think I found a vulnerability" but actually exploits it, that it's any less valuable to someone in charge of network security?
If you're trying to secure a system, a tool which identifies the vulnerabilities is of great use. This tool doesn't find the vulnerabities, you have to do that yourself. Once you find a vulnerable webpage, you use this tool to exploit it.
It's kind like checking a building for open doors, actively trying to jimmy the doors, or see how easily the locks can be picked. That's valuable as it identifies weaknesses. This tool would be more akin to going in and stealing things after someone else pointed out the unlocked door.
Of course no-one has pointed out the political angle. I doubt RedHat wants to host a tool in the repositories whose stated purpose is for compromising Microsoft SQL databases.
Re: (Score:2)
So, in other words, this is another in a long line of questionable and sensationalistic articles by The Register? I don't even bother to read anything they publish anymore, because their standards are so low these days.
Everything seemed to go downhill starting with that series of articles they ran a few years ago where they published truly bizarre and (AFAIK) unsubstantiated claims about some dot-com CEO.
Re: (Score:3, Interesting)
This software does not secure or test anything. [...]
There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server
Sounds pretty handy as a password recovery tool for database servers.
Re: (Score:2)
"It's not like anyone capable of using such tools cannot handle tar, make, and make install."
Hopefully not on fedora. You shouldn't install from source on binary based systems the package manager doesn't know about your install and this can lead to library incompatibilities. In the best case this will cause something to break, in the worst case it will lead to application instability and bitrot similar to that seen on windows.
You should always roll up an RPM if there isn't one available.
Re: (Score:2)
Those that want this specific tool (black, white,or grey hat) will know how to get it. It's not like anyone capable of using such tools cannot handle tar, make, and make install.
What if you have a red hat?
That is definitely a problem ... unless it's a fedora.
That's Interesting (Score:1, Interesting)
Re: (Score:2)
WOW lol ? Ok, lets start holding distro's liable for providing basic things like tcpdump.
Re:That's Interesting (Score:5, Insightful)
From reading the minutes, it seems like the Fedora board rejected it, not because it's a hacker tool (they include jack-the-ripper), but because it doesn't provide any real benefit for their customer base, certainly not enough to outweigh the small legal risk entailed. Fedora isn't a penetration testing distro, it's a server distro. They don't include metasploit either, there's just no demand for it, and the authors of metasploit don't need to get attention for their product by begging people to put it in their distro.
Re: (Score:2)
The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?).
Yes of course, but there are also plugins for e.g. nmap that will give you 'recommendations' for _said_ open ports on target which in the end is also a 'penetration tool' which was one of the reasons for not adding this particular package. So how is that so much different ?
Re: (Score:2)
Really, from reading the minutes, I think they basically decided it wasn't useful enough for their user base. You might disagree, but I t
Re: (Score:3, Insightful)
Re: (Score:2)
Good job. You have demonstrated your capability to read, cut and paste a sentence from the minutes onto slashdot. Do you also have the capability to explain why you think that sentence is particularly important? Please do.
Was just stating from the minutes one of the argumentations that were posted for adding the package, which I see and view as significant. You implied earlier that I should have read the minutes, which I did. I have to use a Fedora box at work so yes I read them all the time, so I can keep up with the binary distro world.
Since you asked, I feel that is an important argument to the package itself and the boards reasoning as a whole, look at some of the other packages that are provided and what they can be use
Re: (Score:2)
My perception is that this tool isn't something you would really install on a Fedora system, if you were doing penetration testing you would use something else, but I could be wrong.
Re: (Score:2)
Here's my 2 cents:
Re:That's Interesting (Score:4, Informative)
From reading the minutes:
"Argument for SQLninja to be added to Fedora is that it is a 'penetration testing tool.' "
Try reading the sourceforge page instead. http://sqlninja.sourceforge.net/sqlninja-howto.html#s1 [sourceforge.net]. It's not a pen testing tool. It's an exploit tool.
Re: (Score:2, Informative)
Try reading the sourceforge page instead. http://sqlninja.sourceforge.net/sqlninja-howto.html#s1 [sourceforge.net]. It's not a pen testing tool. It's an exploit tool.
http://nmap.org/ [nmap.org] this says in the introduction:
"map ("Network Mapper") is a free and open source (license) utility for network exploration or security auditing."
Re: (Score:2)
damn buffer I copied it wrong and hit enter to fast. I meant to say they call it exploration now , although look at the links directly in the navbar , exploits etc what not
Re: (Score:2)
damn buffer I copied it wrong and hit enter to fast. I meant to say they call it exploration now , although look at the links directly in the navbar , exploits etc what not
Well sure exploration implies mapping something out. Exploitation would imply taking advantage of something once it's discovered.
Re: (Score:3, Insightful)
The difference between tcpdump, nmap, and sqlninja is that tcpdump and nmap have a lot of uses (is my port open?).
Yes of course, but there are also plugins for e.g. nmap that will give you 'recommendations' for _said_ open ports on target which in the end is also a 'penetration tool' which was one of the reasons for not adding this particular package. So how is that so much different ?
Because the sole purpose of SQLninja is to exploit a SQL injection vulnerability once detected by other means, not to actually discover them. To me, that is a black hat tool with no redeeming use as a pen testing program.
Re: (Score:2)
Because the sole purpose of SQLninja is to exploit a SQL injection vulnerability once detected by other means, not to actually discover them. To me, that is a black hat tool with no redeeming use as a pen testing program.
Given that security best comes in layers, it would be good to know how much damage a successful injection can do, and design your system in accordance, including alerts for people attempting to use this tool.
Re: (Score:3, Informative)
Re: (Score:2)
And more importantly the name is kewl and sensational. If they called it SQLSecurityVerificationTool, they would have no problems.
Re: (Score:2)
BTW, I am fairly certain that your sig is the reason Nancy Pelosi keeps getting re-elected in San Francisco......yeah, she's just like a Republican....but at least she's not a Republican (although she did represent fairly well in the last yea
Is it something in the water? (Score:2)
"SQLNinja, jack-the-ripper, metasploit."
The geek has a genius for putting names to his projects that are certain to raise red flags.
The Gimp carries baggage into the OSX and Windows shop that the charity providing services for the disabled does not need or want. Fedora and Red Hat need to maintain their credibility in the enterprise environment.
Time and money spent in explanation and recovery - PR - can always be put to better uses.
Re: (Score:2)
Fedora isn't a penetration testing distro, it's a server distro.
What on earth makes you think that? I've never seen any comment from the fedora project to the effect of "this is a server distro". In fact given the bleeding-edge approach Fedora has to including new packages I would suggest that it's not really suited to being a server distro at all. Good enough on the desktop, though.
Re: (Score:2)
Fedora users aren't primarily penetration testers.
Ubuntu users aren't primarily sysadmins.
Every server and desktop Linux box has by definition a "sysadmin", except maybe those where the admin access password has been permanently forgotten (for desktop Ubuntu this means using automatic login without user password) and updates are set to happen automatically. Whether sysadmin job is being done or neglected, that's another matter, but the job exists.
Doing an actual SQL injection attack is a task that doesn't exist for like 99.9% of Linux users. Not to mention, if installing the tool is a problem, t
Re: (Score:2)
Its not censorship since they are not a government entity.
They really aren't exposing themselves any more to suits by including it then not as long as it has a legitimate purpose and there is a statement to some effect that they only intend it to be used that way. ( else every gun and knife maker in the world would be gone by now )
Re: (Score:2)
Censorship isn't restricted to governments. Government censorship just happens to be a particularly nasty type so it's talked about more.
Re: (Score:2)
Re: (Score:2)
Wrong. It's not illegal since they are not a government entity. It's still censorship.
Re: (Score:2)
"I can kind of understand the decision. If someone gets hacked, is the Fedora distribution liable for providing the tool? (Similar to how you can be charged with Accessory to Murder for providing a weapon, or an ISP is now somehow responsible for any illegal traffic.)"
When was the last time Colt or Smith & Wesson were charged with Accessory to Murder?
"Not Fit For Entry" vs. "Drops" (Score:5, Interesting)
Does a package have a right to be included in a distribution?
Is failing to include a package censorship?
Hardly. These are the decisions that distribution maintainers face every day. You can't include everything, so there doesn't really need to be much of a reason to not include any particular program.
Re: (Score:2)
Do people have a right to critique the package inclusion policies?
Certainly.
Nobody seems to be invoking Godwin, just saying that the justification used here sounds a bit off. Had it been "We can't include everything that exists and this package seems to be of limited interest", nobody would even blink.
Re: (Score:2)
Do people have a right to critique the package inclusion policies?
Certainly.
Sure. Do the rest of us have a right to call these people out if we think they're trying to make a mountain out of a molehill? Likewise certain. You seem to be trying to deny the AC the same rights you demand for yourself.
The fact is that post-Grokster, the way a program is marketed is legally significant, and the way this program has been marketed is definitely a bit sketchy, IMO. Grokster didn't lose because their program lacked legal uses; it lost because they promoted the illegal ones.
Re: (Score:2)
The fact is that post-Grokster, the way a program is marketed is legally significant, and the way this program has been marketed is definitely a bit sketchy, IMO. Grokster didn't lose because their program lacked legal uses; it lost because they promoted the illegal ones.
By the same token, if you even imply that you're vetting the legality of packages, it tends to come back to haunt you when someone finds an obscure illegal use for foo that you did include. That's not to say that you can't internally equate probably used illegally with not very interesting.
Re: (Score:2)
The fact is that post-Grokster, the way a program is marketed is legally significant, and the way this program has been marketed is definitely a bit sketchy, IMO. Grokster didn't lose because their program lacked legal uses; it lost because they promoted the illegal ones.
By the same token, if you even imply that you're vetting the legality of packages, it tends to come back to haunt you when someone finds an obscure illegal use for foo that you did include. That's not to say that you can't internally equate probably used illegally with not very interesting.
I think this wasn't about use, but about marketing. So you should say, if someone finds some other packet you included officially marketed as suitable for illegal uses. This can of course happen, but isn't as likely as finding illegal use for, say, a compiler that can be used for writing or downloading and compiling a program that hacks various government computers and initiates a nuclear war.
Re: (Score:2)
it tends to come back to haunt you when someone finds an obscure illegal use for foo that you did include.
No, obscurity doesn't matter. The earlier Betamax case established (thank you Sony) that a tool can be blatantly used primarily for illegal purposes, and still be perfectly legal as long as there exist substantial legal uses. The Grokster case merely narrowed that by establishing that you cannot promote the illegal uses.
Re: (Score:2)
The problem is on the other side of it. If you have a policy of excluding tools that are rimarily for illegal uses, suddenly people try to sue you if one slips through the cracks. OTOH, if you use popularity, utility, or other measures instead, it doesn't come up.
Perhaps that shouldn't (since it is more than a bit self defeating), but it seems to be the case.
LOL @ Censorship tag. (Score:4, Insightful)
Guess what. You can always install this app yourself, if you really want to use it. I'm sure someone wanting a hacking tool can figure out how to install software...
Re: (Score:1)
Re: (Score:2)
Sadly many "hackers" cannot figure out how to download such tools.
That may be. If so, those types don't qualify as "hackers" in any sense of the word. Script kiddies, maybe, or just vandals ... but not hackers.
Re: (Score:2)
Sadly many "hackers" cannot figure out how to download such tools.
And that's actually best reason to exclude any "hacker tool" for official distributions, unless they have a solid use case for regular Linux-user
And yes, testing what ports are open is a solid use case, even if these days it probably goes way over the head of most regular Linux users. IMHO of course.
Censorship != government censorship (Score:2)
(transitive) To review in order to remove objectionable content from correspondence or public media, either by legal criteria or with discretionary powers
http://en.wiktionary.org/wiki/censor#Verb [wiktionary.org]
Censorship can be by a government, or it can be by a private party. In the latter case, arbitrary censorship is usually OK. For governments, they usually have to meet some reasonable constitutional or judicial standard.
Re: (Score:1)
The MPAA ratings are not done by any government body, but they still censor movies when someone in the movie says fuck, copulates with same/different sex or mindlessly kills people.
Censorship is not just when governments do it. And no one prevents me to say "fuck" either. Yet.
The problem per se is not that Fedora removes a package. The problem is their reasoning especially when there tons of other penetration testing tools still existing in Fedora. It's their choice if they want a non-offensive, family frie
Re: (Score:2)
The MPAA ratings are not done by any government body, but they still censor movies ...
Technically the MPAA is a rating board. They don't actually cut anything. The power arises from the distribution chain that won't widely screen any movie with a rating above PG-13. I've even seen a few movies distributed unrated if the director has a loyal enough following and not terribly high commercial prospects to begin with.
If more consumers chose to ignore the ratings, we'd be better off. You can usually figure out whether a movie is suitable from any competent film review. All it takes is three
Re: (Score:2)
I swear, some people really need to read about the concept of censorship. I wasn't aware that Fedora was a government entity, and that they just banned an app from ever being used. Guess what. You can always install this app yourself, if you really want to use it. I'm sure someone wanting a hacking tool can figure out how to install software...
Yeah, the 'Fed' in Fedora just got a whole new meaning.
Re: (Score:2)
Yes, yes they do. Can you believe that there are people who think censorship is somehow an activity that's exclusive to the government?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Ladies and Gentlemen (Score:2)
Exaggerate much? (Score:5, Insightful)
"In what can only be described as a fit of insanity"
Holy crap. Get some perspective. It's not that big a deal. Go outside and get some fresh air and sunshine.
time to switch to debian or ubuntu (Score:1)
Re: (Score:3, Informative)
Quid Pro Quo (Score:1)
Re: (Score:2)
This is about Fedora, not RHEL.
Re: (Score:2)
You may be right, but it would be especially ironic since if those companies would have had ninjaSQL, and used it effectively in testing their networks, then they wouldn't have been a victim of SQL exploits in the first place...
It's an exploit tool, not a vulnerability checker (Score:5, Insightful)
You may be right, but it would be especially ironic since if those companies would have had ninjaSQL, and used it effectively in testing their networks, then they wouldn't have been a victim of SQL exploits in the first place...
This isn't a tool to find vulnerabilities. It's a tool to exploit them once found.
From the sourcforge page for this tool
"Sqlninja's goal is to exploit SQL injection vulnerabilities on web applications that use Microsoft SQL Server as back end. It is released under the GPLv2.
There are a lot of other SQL injection tools out there but sqlninja, instead of extracting the data, focuses on getting an interactive shell on the remote DB server and using it as a foothold in the target network. In a nutshell, here's what it does: "
As you probably have figured out, sqlninja does not look for SQL injection vulnerabilities. Again, there are already several tools that perform that task already.
You find vulnerabilities by attempting to exploit (Score:3, Insightful)
How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?
Re: (Score:2)
How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?
Valid points. Still doesn't mean that Redhat should include this in their repositories any more than they should include virus building tools.
Re: (Score:2)
How do you expect to test if someone can break into your system with SQLNinja without running it and attempting to break in? How do you plan on proving to upper management that there really is a vulnerability, and that your conjecture that you could break in is something more than mere conjecture?
How do you expect to test if someone can install a botnet on your servers via running IE as admin to visit porn sites unless you use IE on your servers as admin to visit porn sites?
Re: (Score:2)
time for Wikileaks to ferret this out then.
Published on lwn.net last Wednesday (Score:3, Informative)
Fine Lines... (Score:3, Insightful)
Being reasonable requires we be willing to draw lines and pass judgement. There are some tools that are mostly legitimate, some that see substantial illegitimate use, and some that are mostly illegitimate. It's fine for a Linux distro to decide not to ship with (or include in repositories) tools that are mostly used for illegitimate ends, even if they have some theoretical legitimate uses. They're not under any obligation to package everything, and "stuff that's mostly used to do harm" is just as reasonable to filter out as "things with ugly licenses".
By analogy, it is usually hard to get lockpicking tools, assault weapons/vehicles, nuclear materials, radar detectors, unsafe foods, homemade alcohols, and many other things in most countries. Can you manage it? Usually, either by legitimate means if you can get a permit, or by making them yourself.
This is entirely different (and much more mild) than blacklisting those applications.
Re: (Score:2)
The thing I like about Unix is that everything is designed to give me more power. No "Oh, you can't do that because you might hose your computer." or "You can't have that because you could use it for hacking!". If I want something done, my computer damn well does it.
From this perspective, rejecting a package from a repository because it gives the user the wrong sort of power is an alien concept. Fortunately, the idea of open source is that something like this is never permanent - it lasts only until someone includes the package in a competing repository.
Since I tend not to trust 3rd party repositories, it means that it lasts until I switch to another distro.
Much ado about nothing? (Score:4, Interesting)
While I'll be the first to acknowledge that this is clearly a "CYA" move on Fedora's part, I don't see why it is such a big deal. Ubuntu/Debian don't appear to have this tool in their repositories, and I'm pretty sure SuSE doesn't either, so it's not like Fedora is bucking a consensus. If there's enough demand for it, RPM Fusion will probably pick it up.
Furthermore, if the person responsible for your network vulnerability testing doesn't have the basic skills to install it from the upstream sources, is this really the caliber of person you want to trust with your network security?
This is why I use SuSE Studio. (Score:2)
I can always cook up whatever distro I want. Despite the issues with nmap and friends, I can always build an image with things like SQLNinja.
Not a security analysis tool (Score:5, Informative)
Disclaimer: I used to work for Red Hat and personally know some of the board.
SQLNinja is not a security analysis tool. It is no more useful for telling you if your database app is insecure than a blowtorch is for telling you if you have a gas leak. SQL injection vulnerabilities are *trivial* to detect with simple input fuzzing.
SQLNinja is certainly a legitimately useful *demonstration* tool for developers and administrators to show their bosses just how severe their problems are, such that they might be prioritized, but it's designed for software that doesn't even run on Fedora, so it provides negligible benefit to the Fedora community. Anyone who knows enough to search for "SQL injection tool" can find it and install it, so there's really not much of a barrier here, but leaving it out of the distribution reduces the risk of Fedora being used as a gateway to the fat wallet of Red Hat in any litigation, a problem which most community distributions do not suffer from.
Fedora takes a lot of moral stands, but they're ultimately about things that will somehow benefit the Fedora community in the long term, and there's really no foreseeable payoff here, or certainly none that overrides the fantastic headache it could incur. I certainly can't fault them for picking their battles.
bye bye security (Score:2)
to continue this trend, it would be a bye bye to security. Every single "hacker tool" is a 2 edged sword, it can be used for both good and bad. Just like almost anything can be used for good and bad. Should we ban knives because some people use them to hack'n'slice living meat (people) instead of dead?
Maybe we should just lock ourselves into soft rooms, there's the least likelyness for using anything for bad, and problem will soon be completely solved as we would die out as a race, no more people to do bad
Re: (Score:3, Funny)
Yeah, that'd just be copying Ubuntu.