SQL injection and DOS attack modules

Metasploit is friendly for both penetration testers as well as hackers. The reason for this is that a penetration tester has to think from the hacker's perspective in order to secure their network, services, applications, and so on. The SQL injection and DOS modules helps penetration testers in attacking their own services in order to figure out if they are susceptible to such attacks. So let's discuss some of these modules in detail.

Getting ready

The SQL injection module uses a known vulnerability in the database type to exploit it and provide unauthorized access. The vulnerability is known to affect Oracle 9i and 10g. Metasploit contains several modules that use a known exploit in the Oracle database in order to break them through query injection. The modules can be found in modules/auxiliary/sqli/oracle.

How to do it...

Let us analyze an oracle vulnerability named Oracle DBMS_METADATA XML vulnerability. This vulnerability will escalate the privilege...