---
id: 8385
title: "SQL Injection: Death by Blacklist"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/sql-injection-death-by-blacklist/"
published_at: "2010-12-22T00:00:00Z"
tags: ["sql-injection", "web-security", "waf", "whitelist", "blacklist", "xp-cmdshell"]
phying_url: "https://phying.com/item/8385"
lang: en
---

# SQL Injection: Death by Blacklist

## Summary

A NetSPI post argues blacklist filtering fails against SQL injection like signature-based antivirus, showing xp_cmdshell bypass tricks and urging whitelisting or WAF modules already on network gear.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2010-12-22T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/sql-injection-death-by-blacklist/
- **Phying News:** https://phying.com/item/8385