---
id: 5129
title: "Advanced MSSQL Injection Tricks"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/"
published_at: "2020-11-12T13:22:48Z"
tags: ["pentesting", "sql-injection", "methodology", "mssql"]
phying_url: "https://phying.com/item/5129"
lang: en
---

# Advanced MSSQL Injection Tricks

## Summary

A collection of advanced MSSQL injection techniques tested on SQL Server 2019/2017/2016SP2: DNS out-of-band exfiltration via fn_xe_file_target_read_file and friends, WAF-bypassing error-based vectors, single-query table dumps with FOR JSON, and local file reads via OpenRowset.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2020-11-12T13:22:48Z
- **Original:** https://swarm.ptsecurity.com/advanced-mssql-injection-tricks/
- **Phying News:** https://phying.com/item/5129