Re: Informix SQL injection

["Zed Qyves" <zqyves.spamtrap () gmail com>]

> From database hackers handbook courtesy of David Litchfield
---------------------------------------------------------------------------------------------

First create your temptable via standard SQL.

INSERT INTO temptable (name,conts) VALUES ('resultsfile',
FILETOCLOB('/tmp/result', 'server'))

Then select from that
------------------------------------------------------------------------------------------

The last param ('server') tells the command where to load the file
from. I am assuming that your commands run on the imformix server
macine, provided it is in a different server than the webserver.
However by changing it to 'client' you can load files from the client
side of the connection i.e the web server i.e. source code from the
web pages of the application.

have fun...

ZQ

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/