sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

PySQLRecon

PySQLRecon PySQLRecon is a Python port of the awesome SQLRecon project by @sanjivkawa. See the commands section for a list of capabilities. Post demonstrating SCCM TAKEOVER-1 with PySQLRecon. Install PySQLRecon can be installed with pip3 install pysqlrecon or by cloning this repository and runnin...

xolo

XOLO Author: ET Lownoise Version: 1.0 Tool to crawl, visualize and interact with SQL server links in a d3 graph to help in your red/blue/purple/.../risk assessments pentest hacking team exercises. Requirements: root@kitploit: Requests==2.18.4 Flask==0.12.2 Json Pypyodbc beautifulsoup4==4.6.0...

CVE-2020-0618

CVE-2020-0618 RCE in SQL Server Reporting Services CVE-2020-0618 Vulnerability Verification POC The following HTTP request can be sent to the server to exploit the application: root@kitploit: POST /ReportServer/pages/ReportViewer.aspx HTTP/1.1 Host: target Content-Type:...

MultiExploit

Multi-Service Vulnerability Scanner Supported Vulnerabilities & Attack Vectors Microsoft SQL Server Vulnerabilities CVE-2023-21173 : Remote Code Execution in SQL Server 2022 Potential exploitation of: Weak authentication configurations Misconfigured server principals xpcmdshell abuse Advanced...

ghauri

Like Ghauri, consider supporting the developer...

SQLRecon

SQLRecon SQLRecon is a Microsoft SQL Server toolkit that is designed for offensive reconnaissance and post-exploitation. For detailed information on how to use each technique, refer to the wiki. You can download a copy of SQLRecon from the releases page. Alternatively, feel free to compile the...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

CVE-2019-1068

CVE-2019-1068 Root cause analysis and PoC for a Microsoft SQL Server Stack Overflow Vulnerability by reversing “svl.dll”. Links to our work: 1. Ataberk's Blog 2. Fatih's Blog 3. Cem's Blog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...

PowerUpSQL

PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

CVE-2008-5416

CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin Memory Corruption via SQL Injection A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT（M icros oft SQL D atabase A ttacking T ool）是一款开源渗透测试工具，用于远程测试 Microsoft SQL 数据库的安全性。 MSDAT 的使用场景示例： 你有一个远程监听的 Microsoft 数据库，想要查找有效凭据以连接数据库 你有一个有效的 Microsoft SQL 帐户，想要提升权限 你有一个有效的 Microsoft SQL 帐户，想要在托管该数据库的操作系统上执行命令（例如...

xolo

XOLO 作者：ET Lownoise 版本：1.0 用于爬取、可视化并以 d3 图形式交互 SQL 服务器链接的工具，可协助您的红/蓝/紫/.../风险渗透测试黑客团队演练。 要求： root@kitploit: Requests==2.18.4 Flask==0.12.2 Json Pypyodbc beautifulsoup4==4.6.0 lxml==4.1.0 示例： pip install pypyodbc python -m pip install pypyodbc 安装/运行： root@kitploit: - 下载 - 解压 - 放入目录 - 运行它...

SQLC2

SQLC2 SQLC2 es un script de PowerShell para implementar y gestionar un sistema de comando y control que utiliza SQL Server como servidor de control y agente. En esencia, SQLC2 es solo un script de PowerShell, un script TSQL y unas pocas tablas en una instancia de SQL Server que realiza un...

CVE-2025-24999

CVE-2025-24999 proof of concept for CVE-2025-24999 https://databasesecurityninja.wordpress.com/2026/04/02/microsoft-sql-server-privilege-elevation-through-msdatabasemanager-role-cve-2025-24999/...

sqlwinds

SQLWinds Kit de Evaluación de Seguridad y Post-Explotación para SQL SQLWinds es una herramienta de línea de comandos para pruebas de seguridad y explotación de Microsoft SQL Server. Proporciona un entorno interactivo para analizar servidores en profundidad, escalar privilegios, ejecutar ataques y...

CVE-2020-0618_DETECTION

CVE-2020-0618 - PoC de Detección de RCE en Microsoft SQL Server Reporting Services SSRS 📜 Descripción Este es un PoC sencillo para detectar CVE-2020-0618 , una vulnerabilidad de ejecución remota de código que afecta a Microsoft SQL Server Reporting Services SSRS. La vulnerabilidad existe debido a...

DiagTrackEoP

DiagTrackEoP Solo otra forma de abusar del privilegio SeImpersonate. Este PoC está basado en este blog de @crisprss. En este blog @crisprss mostró un método interesante para abusar del privilegio SeImpersonate usando AzureAttestService, que viene con versiones recientes de SQL server; el PoC se...

cve-2024-50330-ivanti_epm_sqli_reproduction

CVE-2024-50330: Ivanti Endpoint Manager EPM Inyección SQL a RCE Resumen CVE-2024-50330 es una vulnerabilidad de inyección SQL crítica sin autenticación previa en Ivanti Endpoint Manager EPM que permite a un atacante remoto no autenticado lograr la ejecución remota de código en el servidor objetiv...