Re: SFX-SQLi: A new SQL injection technique for MSSQL (dumps a table in one request!)

[Razi Shaban <razishaban () gmail com>]

On Sun, Feb 8, 2009 at 6:16 PM, Roman Medina-Heigl Hernandez
<roman () rs-labs com> wrote:
> Razi Shaban escribió:
> > > I am glad to release SFX-SQLi (Select For XML SQL injection), a new SQL
> > > injection technique which allows to extract the whole information of a
> > > Microsoft SQL Server 2005/2008 database in an extremely fast and efficient
> > > way.
> >
> > This isn't new, this is old news. It might be the first paper written
> > about the topic, but these methods have been used for years.
>
> Please, Razi, could you name any reference? I suppose that if the method is
> well-known, as you're suggesting, it shouldn't be difficult at all to find
> at least one. I can't believe no tool is implementing such a great idea, if
> it is "old news".
>
> --
>
> Saludos,
> -Roman

Not reference, not white paper, not tool. I am talking about the real
internet, where things aren't talked about but actually happen.
Hackers have been using methods similar to this for years, it's about
time a white-hat discovered this.

Regards,
Razi Shaban