SQLRecon

SQLRecon SQLRecon is a Microsoft SQL Server toolkit that is designed for offensive reconnaissance and post-exploitation. For detailed information on how to use each technique, refer to the wiki. You can download a copy of SQLRecon from the releases page. Alternatively, feel free to compile the...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2019-1068

CVE-2019-1068 Root cause analysis and PoC for a Microsoft SQL Server Stack Overflow Vulnerability by reversing “svl.dll”. Links to our work: 1. Ataberk's Blog 2. Fatih's Blog 3. Cem's Blog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

MSSQLand

✈️ MSSQLand Land gracefully in your target Microsoft SQL Server MS SQL DBMS, as if arriving on a business-class flight with a champagne glass in hand. 🥂 MSSQLand is a C Microsoft SQL Server MSSQL / MS SQL post-exploitation tool built for red team operators. Designed to run inside the target...

xolo

XOLO Author: ET Lownoise Version: 1.0 Tool to crawl, visualize and interact with SQL server links in a d3 graph to help in your red/blue/purple/.../risk assessments pentest hacking team exercises. Requirements: Requests==2.18.4 Flask==0.12.2 Json Pypyodbc beautifulsoup4==4.6.0 lxml==4.1.0 Example...

CVE-2008-5416

CVE-2008-5416 Microsoft SQL Server spreplwritetovarbin Memory Corruption via SQL Injection A heap-based buffer overflow can occur when calling the undocumented "spreplwritetovarbin" extended stored procedure. This vulnerability affects all versions of Microsoft SQL Server 2000 and 2005, Windows...

CVE-2023-54400

Fumasoft Fumeng Cloud is vulnerable to a SQL injection in the AjaxMethod.ashx endpoint. Unauthenticated remote attackers can inject arbitrary SQL via the Name parameter of the getEmpByname action. By using UNION-based SQL injection techniques against the Microsoft SQL Server backend, attackers ca...

EUVD-2023-60696

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

PowerUpSQL

PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also...

PySQLRecon

PySQLRecon PySQLRecon 是 @sanjivkawa 所创优秀项目 SQLRecon 的 Python 移植版。功能列表请参阅命令章节。 文章演示了如何使用 PySQLRecon 实现 SCCM TAKEOVER-1。 安装 可通过 pip3 install pysqlrecon 安装 PySQLRecon，或克隆本仓库后运行 pip3 install .。 命令 SQLRecon 的所有主要模块均有对应命令。标注 PRIV 的命令需要提升权限或 sysadmin 权限才能运行。标注 NORM 的命令普通用户通常也可运行，无需提升权限。...

msdat

Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT（M icros oft SQL D atabase A ttacking T ool）是一款开源渗透测试工具，用于远程测试 Microsoft SQL 数据库的安全性。 MSDAT 的使用场景示例： 你有一个远程监听的 Microsoft 数据库，想要查找有效凭据以连接数据库 你有一个有效的 Microsoft SQL 帐户，想要提升权限 你有一个有效的 Microsoft SQL 帐户，想要在托管该数据库的操作系统上执行命令（例如...

CVE-2020-0618

CVE-2020-0618 SQL Server Reporting ServicesCVE-2020-0618中的RCE 漏洞验证POC 可以将以下HTTP请求发送到服务器以利用该应用程序: POST /ReportServer/pages/ReportViewer.aspx HTTP/1.1 Host: target Content-Type: application/x-www-form-urlencoded Content-Length: X...

CVE-2026-101878

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878

Bitwarden Server versions 2025.6.0 before 2026.5.0 are vulnerable to an authentication bypass on SQL Server deployments. The root cause is an identifier truncation issue where the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure is declared as NVARCHAR(50),...

EUVD-2026-88605

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

CVE-2026-101878 Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the UserReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR50 while the column it queries stores NVARCHAR300, silently truncating the SSO login identifier on SQL Server deployments and allowing a user...

SQLC2

SQLC2 SQLC2 es un script de PowerShell para implementar y gestionar un sistema de comando y control que utiliza SQL Server como servidor de control y agente. En esencia, SQLC2 es solo un script de PowerShell, un script TSQL y unas pocas tablas en una instancia de SQL Server que realiza un...