PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Advanced MSSQL Injection Tricks

swarm.ptsecurity.com | research | #pentesting | #sql-injection | #methodology | #mssql
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A collection of advanced MSSQL injection techniques tested on SQL Server 2019/2017/2016SP2: DNS out-of-band exfiltration via fn_xe_file_target_read_file and friends, WAF-bypassing error-based vectors, single-query table dumps with FOR JSON, and local file reads via OpenRowset.
Published
Collected

Related coverage

research · portswigger.net
How I choose a security research topic
James Kettle on choosing security research topics: evaluate how quickly you can fail, chase what scares you, and know when to push on, using his race-conditions research as a case study.
research · portswigger.net
Hunting evasive vulnerabilities
James Kettle's Nullcon keynote explores evasive vulnerabilities from a decade of research — too advanced, too silly or well-masked to spot — extracting principles for finding overlooked flaws.
research · portswigger.net
How to turn security research into profit: a CL.0 case study
Strategies for turning security research into bounty profit, using the CL.0 desync class as a case study: assess competition, find gaps in released scanners, and act before a technique saturates.
research · hackenproof.com
How to Read Any Smart Contract Project Without Getting Lost
A methodology guide on reading unfamiliar smart contract projects without getting lost, aimed at security researchers and auditors facing large, complex codebases.
research · slcyber.io
A Novel Technique for SQL Injection in PDO's Prepared Statements
Assetnote details a novel SQL injection technique in PHP PDO prepared statements, exploitable under specific conditions including Postgres backends.
research · slcyber.io
Loose Types Sink Ships: Pre-Authentication SQL Injection in Halo ITSM
Assetnote discovers a pre-authentication SQL injection vulnerability in Halo ITSM, exploitable due to loose type handling in the codebase.
Back