MySQL Database is a great product used by thousand of websites.
Various web applications use MySQL as their default database.
Some of these applications are written with security in mind, and
some are not. In this article, I would like to show you how you
can exploit SQL injection in order to gain almost full control
over your webserver.
Most people know that SQL injection allows attackers to retrieve
database records, pass login screens, change database content,
through the creation of new administrative users. MySQL does not
have a built-in command to execute shell commands, like Microsoft
SQL server. I will show you how to run arbitrary commands using
standard features provided by MySQL.
First of all, I would like to give a brief description of SQL
injection, then I would like to present you with a couple less
known methods that exist in MySQL, which I will use to backdoor a
webserver. I will use 2 built-in MySQL commands - one …
[Read more]