sQuo Posted October 14, 2012 Share Posted October 14, 2012 This is the hidden content, please Sign In or Sign Up SFX-SQLi (Select For XML SQL injection) is a new SQL injection technique which allows to extract the whole information of a Microsoft SQL Server 2005/2008 database in an extremely fast and efficient way. This technique is based on the FOR XML clause, which is able to convert the content of a table into a single string, so its contents could be appended to some field injecting a subquery into a vulnerable input of a web application. In addition to a new web application for testing, a new revision of the tool is published with some minor fixes and changes, including new functionality like access to other databases in the same server or support for user defined queries Paper in This is the hidden content, please Sign In or Sign Up PaperDetailed description of how the technique works and its fundamentals UPDATE (28/03/2010): In addition to a new web application for testing, a new revision of the tool is published with some minor fixes and changes, including new functionality like access to other databases in the same server or support for user defined queries: Download the This is the hidden content, please Sign In or Sign Up (binaries)A tool which automates the process (requires Microsoft .NET Framework 2.0) - v1.1 Download the This is the hidden content, please Sign In or Sign Up Tool (source code)Source code of the tool (available in VB.NET for Visual Studio 2008) - v1.1 Download an This is the hidden content, please Sign In or Sign Up (ASP.NET)Vulnerable web application sample for testing (includes executable and source code) Link to comment Share on other sites More sharing options...
Recommended Posts