Nytro Posted August 9, 2009 Report Share Posted August 9, 2009 E-BookTable of Contents[Abstract]...........................................................................................................................3[Introduction].....................................................................................................................3[Obtaining Information Using Error Messages].................................................................7[Leveraging Further Access].............................................................................................12[xp_cmdshell]...............................................................................................................12[xp_regread]..................................................................................................................13[Other Extended Stored Procedures]............................................................................13[Linked Servers]............................................................................................................14[Custom extended stored procedures]...........................................................................14[Importing text files into tables]...................................................................................15[Creating Text Files using BCP]...................................................................................15[ActiveX automation scripts in SQL Server]................................................................15[Stored Procedures]...........................................................................................................17[Advanced SQL Injection]................................................................................................18[Strings without quotes]................................................................................................18[Second-Order SQL Injection]......................................................................................18[Length Limits].............................................................................................................20[Audit Evasion].............................................................................................................21[Defences]........................................................................................................................21[Input Validation]..........................................................................................................21[SQL Server Lockdown]...............................................................................................23[References].....................................................................................................................24Appendix A - 'SQLCrack'.................................................................................................25(sqlcrack.sql).................................................................................................................25Download:http://www.ngssoftware.com/papers/advanced_sql_injection.pdf Quote Link to comment Share on other sites More sharing options...
