Full Disclosure mailing list archives
Re: Informix SQL injection
From: "Zed Qyves" <zqyves.spamtrap () gmail com>
Date: Tue, 6 Feb 2007 10:36:19 +0200
From database hackers handbook courtesy of David Litchfield
--------------------------------------------------------------------------------------------- First create your temptable via standard SQL. INSERT INTO temptable (name,conts) VALUES ('resultsfile', FILETOCLOB('/tmp/result', 'server')) Then select from that ------------------------------------------------------------------------------------------ The last param ('server') tells the command where to load the file from. I am assuming that your commands run on the imformix server macine, provided it is in a different server than the webserver. However by changing it to 'client' you can load files from the client side of the connection i.e the web server i.e. source code from the web pages of the application. have fun... ZQ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Informix SQL injection Joshua Tagnore (Feb 05)
- Re: Informix SQL injection Tyop? (Feb 05)
- <Possible follow-ups>
- Re: Informix SQL injection Zed Qyves (Feb 06)