Collected research

Advanced MSSQL Injection Tricks

PT SWARM Team and @ptswarm · PT SWARM

A set of MSSQL injection techniques: DNS out-of-band exfiltration through fn_xe_file_target_read_file, fn_get_audit_file and fn_trace_gettable, error-based extraction from type conversion errors in functions such as USER_NAME, whole-table dumping with FOR JSON, local file reads via OpenRowset, and WAF bypasses using unusual whitespace and 0x or 0e prefixes.

Record

Researcher

PT SWARM Team and @ptswarm

Published by

PT SWARM

Topic

Injection

In the archive

• Collected in the 2020 research round

Tags

• sqli
• mssql
• waf-bypass
• filter-bypass
• lfi
• info-leak
• dns
• database
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of PT SWARM Team and @ptswarm, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.