Re: custom xp_cmdshell on SQL Server

From: Stefano Zanero (s.zanero@securenetwork.it)
Date: Fri Sep 15 2006 - 05:35:32 EDT


Andy Lester wrote:
> Hello list,
>
> I am pen-testing a web app that is vulnerable to SQL Injection. The
> queries to the backend DB are done with a non-privileged user, but using
> OPENROWSET and inference-based injection I have been able to find the sa
> password and escalate privileges.

Did you have a look at SQL Ninja ?
http://sqlninja.sourceforge.net/

It's a handy tool when you deal with SQL Server.

Stefano

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------



This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:56:57 EDT