security enabled verified high v1.0.0

sqlninja

SQL Server injection and takeover tool that exploits blind SQL injection vulnerabilities for privilege escalation, command execution, and data extraction.

📋 Live Preview

sqlninja {flag-mode} {flag-payload} {flag-timeout} -f {conf}

📎 flag-mode 📎 flag-payload 📎 flag-timeout 📎 conf

sqlninja {flag-mode} {flag-payload} {flag-timeout} -f {conf}

Sandbox: execFile · Timeout: 600s

Capabilities

sqli.blind-exploit

sqli.mssql-inject

sqli.cmd-exec

sqli.privilege-escalation

sqli.data-exfil

Parameters

Name	Type	Required	Default	Description	Aliases
`conf`	string	Yes	-	Configuration file for the target	`-f`, `--conf`
`flag-mode`	string	No	-	Mode (test, attack, sql-shell, os-shell, etc.)	`-m`, `--mode`
`flag-payload`	integer	No	-	Payload type number	`-p`, `--payload`
`flag-timeout`	integer	No	-	Query timeout in seconds	`-t`, `--timeout`

Artifacts

Type	Description	MIME	Schema	Trust
`sqli.output`	SQL injection exploitation results	text/plain	-	verified
`sqli.shell`	Command shell via SQL injection	text/plain	-	verified

Contract

Inputs

network.target.host

Target SQL Server host

network.port

Target SQL Server port

web.target.url

URL with injection point

Outputs

sqli.output

Command execution output

sqli.shell

Interactive shell session

Side effects: network_traffic

Workflow Edges

Produces

sqli.outputsqli.shell

Consumes

network.target.hostnetwork.portweb.target.url

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	low

Examples

Test injection point

sqlninja -f target.conf -m test

Get SQL shell

sqlninja -f target.conf -m sql-shell

Get OS shell

sqlninja -f target.conf -m os-shell

Extract data

sqlninja -f target.conf -m data

Documentation

Sqlninja — SQL Server Injection Toolkit

Sqlninja is a Perl-based tool for exploiting blind SQL injection vulnerabilities in Microsoft SQL Server. It provides features for privilege escalation, command execution, data extraction, and reverse shell access via out-of-band channels.

Usage

# Test injection point (after editing target.conf)
sqlninja -f target.conf -m test

# Interactive SQL shell
sqlninja -f target.conf -m sql-shell

# Interactive OS shell (via xp_cmdshell)
sqlninja -f target.conf -m os-shell

# Data extraction
sqlninja -f target.conf -m data

Dependencies

perlnmap

Related Tools

sqlmapghaurinmap

References

Sqlninja GitHub