AOH :: HP Unsorted S :: VA2539.HTM

SFX-SQLi: A new SQL injection technique for MSSQL (dumps a table in one request!)



SFX-SQLi: A new SQL injection technique for MSSQL (dumps a table in one request!)
SFX-SQLi: A new SQL injection technique for MSSQL (dumps a table in one request!)



Hi,

I am glad to release SFX-SQLi (Select For XML SQL injection), a new SQL
injection technique which allows to extract the whole information of a
Microsoft SQL Server 2005/2008 database in an extremely fast and efficient
way.

This technique is based on the FOR XML clause, which is able to convert the
content of a table into a single string, so its contents could be appended
to some field injecting a subquery into a vulnerable input of a web
application. In most cases, this method can dump all the contents of any
table using only ONE REQUEST to the web server, without the need of any
special permission on the DBMS.

I have written a paper describing how the technique works and in which
fundamentals it is based, and I have also developed a tool which implements
this technique as a proof of concept (with the source code included). 

You can get them through this URL:

http://www.kachakil.com/papers/SFX-SQLi-en.htm 

Regards,
  Daniel Kachakil





The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.