Friday, July 3, 2009

ONE CLICK OWNAGE

by Ferruh Mavituna

This is a different and more practical approach to get a reverse shell
or code execution in SQL Injections (particularly in MSSQL). The idea
is simple. Getting a reverse shell from an SQL Injection with one HTTP
request without using an extra channel such as TFTP, FTP to upload the
initial payload.

White paper explains the steps and the details of the attack. Scripts
got all the tools you need to create your HTTP request with your own
payload.


Download: White Paper

Download: Scripts

Presentation: IT Underground 2009

No comments: