Sqlninja is a tool written in PERL to exploit SQL Injection vulnerabilities on a web application that uses Microsoft SQL Server as its back-end. Its main goal is to provide a remote access on the vulnerable DB server, even in a very hostile environment. It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered.
Being able to upload 'netcat.exe' as 100% plain ASCII GET/POST requests and no FTP? Evasion techniques, code obfuscation, and DNS-tunneld pseudo shells? Sounds like an SQL Injection tool to check out!
