Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I learned about the recent Barracuda hack, which sources say used an automated tool to locate some PHP file and test it for SQL injections.

At my current company, I feel that security is not the top priority and would like to test our websites for SQL injection vulnerabilities.

What tool would you use for such a purpose ? I found out about the python script sqlmap, but does it automatically find PHP files used on the server ?

share|improve this question
up vote 1 down vote accepted

sqlmap doesn't automatically find the targets, but lets you use proxy logs as source for the target list:

-l LIST Parse targets from Burp or WebScarab proxy logs

Burp homepage:

WebScarab Howto:

Of course, you could also log into the server, get a list of php files and modify it to be a valid URL list (if you're not doing complex rewrites on the webserver).

EDIT - Like so, assuming the server runs GNU/Linux:

find $webroot -iname '*php' | sed -e "s#$webroot#$uri#g"
share|improve this answer
Thanks, I'll try that. I'm worried about forgetting some small php file somewhere, called in Ajax... – Manu Apr 20 '11 at 12:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.