sql-injection-stacked

Stacked query SQL injection enables OS command execution by appending additional SQL statements via semicolons. This Skill facilitates using DBMS-specific functions like xp_cmdshell in MSSQL or COPY TO PROGRAM in PostgreSQL to achieve remote command execution.

Second-order SQL injection occurs when malicious input is stored by the database and later used unsafely in a different query context. This Skill guides penetration testers in identifying and exploiting these delayed execution vulnerabilities across multiple database systems.

Yes, this Skill supports exploiting stacked query SQL injection across MSSQL, PostgreSQL, MySQL, and Oracle. It provides tailored payloads and specific techniques for command execution, data manipulation, and file operations within each supported DBMS environment.

You can write a webshell by leveraging stacked query SQL injection to perform file operations on the target system. This Skill guides penetration testers in using DBMS-specific functions to manipulate files and deploy webshells for persistent access.

Standard SQL injection typically modifies an existing query, while stacked queries append entirely new statements using semicolons. This allows for broader data manipulation and command execution beyond the original query context, enabling operations like invoking xp_cmdshell.