Hacking MS-SQL - From SQLi to Server Administrator

In this video we conduct initial scanning and enumeration on a Windows Server, discover a SQL injection vulnerability in a website, exploit it, and gain access of the server.
Please consider supporting me on Patreon at / themayor
Join the conversation on Discord at / discord
This lab is part of the Web Application Penetration Tester course from eLearnSecurity/INE.

[@craigmac7176]

Great run through, first time i've seen SQLi acted on. Thank you!

[@JoeHellethemayor]

Glad you enjoyed it!

[@HMBK2077]

Thanks for sharing. Your video helps me a lot in CTF .

[@ewinwahyu7763]

Thanks for your help and support brother

[@marcovicentin5010]

Great video! Thanks you!👍

[@JoeHellethemayor]

Thanks for watching!

[@slayerplayz9405]

Unable to upload exe file on server via certutil.exe

[@KennyB1990]

Could this type of exploit be done against Windows Server 2012 or above? Doing a pen testing project at uni. Great Video :)

[@JoeHellethemayor]

Hey thanks! As far as I'm aware no version of MS-SQL is immune from SQLi. So to your question, yes. In regards to actually getting command shell access to the server, that requires the xp_cmdshell setting to be enabled by the administrator, or disabled but re-enabled if possible. Here's a list of MS-SQL payloads for your project if you don't have it already. github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MSSQL%20Injection.md Cheers!

[@Free.Education786]

Also teach us how to BYPASS 403 forbidden error, 406 WAF error and file UPLOAD restrictions errors.... Thanks for your help and support brother 🤝😘😍❤💚💙🤗🤩👍

[@ruszomalkuko]

What OS is you lab? I can see that raspberry icon and asking if it is possible to consider my raspberry pi 4 be a Cyberlab

[@JoeHellethemayor]

I use Kali with a custom desktop interface I prettied up with some Raspberry Pi stuff. That said, the 8GB version of Kali works very well.

[@goebbelsx]

Thanks. I'm going through hackthebox's prolab offshore and this walkthrough was very useful.

[@JoeHellethemayor]

Awesome! I'm really glad to hear.

[@jorgevilla6523]

Great Video!!

[@JoeHellethemayor]

Thanks! I'm glad you liked it.

[@user-uh5pn4qd3i]

So if a website is using MS Sql as backend, will this method work like sqlmap does for websites that uses MySQL as backend??

[@JoeHellethemayor]

SQLmap can enumerate MSSQL the same as it can MySQL, as shown in the video.

[@reyandutta]

Is this the real TheMayor11 YT chamnel?

[@JoeHellethemayor]

Yep.

[@kirangameng.7442]

Plzz help me my account hack halp

[@martinshudson7561]

its not working for me when i try to use certutil.exe -urlcaxhe -f targetip