execute spWriteStringToFile 'contents', 'C:\path\to\', 'file'Source: SQL Injection/MSSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
SQL Injection · passage 64 of 186
MSSQL Injection: MSSQL Write File
1 code block · SQL Injection/MSSQL Injection.md
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open this passage on GitHubEvery one of the 186 is a mark on the map. Named now: 53 to 78, reading order first.
- MSSQL Injection: MSSQL Enumeration
- MSSQL Injection: MSSQL List Databases
- MSSQL Injection: MSSQL List Tables
- MSSQL Injection: MSSQL List Columns
- MSSQL Injection: MSSQL Union Based
- MSSQL Injection: MSSQL Error Based
- MSSQL Injection: MSSQL Blind Based
- MSSQL Injection: MSSQL Blind With Substring Equivalent
- MSSQL Injection: MSSQL Time Based
- MSSQL Injection: MSSQL Stacked Query
- MSSQL Injection: MSSQL Read File
- MSSQL Injection: MSSQL Write File
- MSSQL Injection: XPCMDSHELL
- MSSQL Injection: Python Script
- MSSQL Injection: MSSQL DNS exfiltration
- MSSQL Injection: MSSQL UNC Path
- MSSQL Injection: MSSQL Trusted Links
- MSSQL Injection: MSSQL List Permissions
- MSSQL Injection: MSSQL Make User DBA
- MSSQL Injection: MSSQL Database Credentials
- MSSQL Injection: MSSQL OPSEC
- MySQL Injection: MySQL Injection
- MySQL Injection: MYSQL Default Databases
- MySQL Injection: MYSQL Comments
- MySQL Injection: MYSQL Testing Injection
- MySQL Injection: Detect Columns Number
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP