Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exploiting Second Order SQL Injection with Stored Procedures

netspi.com | vulnerability | #sql-injection | #second-order | #oob | #web-pentesting | #stored-procedures | #xp-dirtree | #dns-exfiltration

Summary

This walkthrough covers exploiting second-order SQL injection in an Excel report export feature, chaining stored procedure UNC path injection via xp_dirtree to exfiltrate database details over DNS.
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
Hacking SQL Server Stored Procedures – Part 3: SQL Injection
SQL injection inside stored procedures using dynamic SQL can escalate to sysadmin when procedures run with elevated privileges via WITH EXECUTE AS or certificate signing, as this walkthrough shows.
vulnerability · netspi.com
Preventing SQL Injection at the Database
SQL injection vulnerabilities are common out in the real world.
vulnerability · netspi.com
NetSPI SQL Injection Wiki
Open-sources NetSPI's SQL injection wiki, a consolidated knowledge base spanning detection through attack queries across DBMSs, covering data extraction, obfuscation, and pivoting past the DB.
vulnerability · netspi.com
SQL Injection to Help You Sleep at Night
Argues production databases deserve care during pentests and shows read-only SQL injection habits across MySQL, MSSQL, and Oracle so testers can hunt vulnerabilities without corrupting live data.
vulnerability · netspi.com
Is SQL Injection a Terminable Offense?
Reacting to an editorial claiming coders who write SQL injectable code should be fired, the author argues blame extends to architects, DBAs, QA, and decision makers who won't fund real testing.
vulnerability · netspi.com
SQL Injection: Death by Blacklist
No one can deny that SQL Injection is one of the biggest issues plaguing web applications today. However, there is still some ongoing debate around how to fix it.
back