full-disclosure - SFX-SQLi: A new SQL injection technique for SQL Server (dumps a table in one request!)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <08BED96B74184FB588ABC2C7DBA89B23@DK>
Date: Sat, 7 Feb 2009 17:02:21 +0100
From: "Daniel Kachakil" <dani@...hakil.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: SFX-SQLi: A new SQL injection technique for SQL
	Server (dumps a table in one request!)

Hi,

I am glad to release SFX-SQLi (Select For XML SQL injection), a new SQL 
injection technique which allows to extract the whole information of a 
Microsoft SQL Server 2005/2008 database in an extremely fast and efficient 
way.

This technique is based on the FOR XML clause, which is able to convert the 
content of a table into a single string, so its contents could be appended 
to some field injecting a subquery into a vulnerable input of a web 
application. In most cases, this method can dump all the contents of any 
table using only ONE REQUEST to the web server, without the need of any 
special permission on the DBMS.

I have written a paper describing how the technique works and in which 
fundamentals it is based, and I have also developed a tool which implements 
this technique as a proof of concept (with the source code included).

You can get them through this URL:

http://www.kachakil.com/papers/SFX-SQLi-en.htm

Regards,
  Daniel Kachakil 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/