fuzzdb/attack/sql-injection/exploit

various useful post-exploitation commands

ms-sql-enumeration.fuzz.txt

• ms-sqli info disclosure payload fuzzfile
• replace regex with your fuzzer for best results
• run wireshark or tcpdump, look for incoming smb or icmp packets from victim
• might need to terminate payloads with ;--

mysql-injection-login-bypass.fuzz.txt

• regex replace as many as you can with your fuzzer for best results:
• also try to brute force a list of possible usernames, including possile admin acct names

mysql-read-local-files.fuzz.txt

• mysql local file disclosure through sqli
• fuzz interesting absolute filepath/filename into