Using Burp to Exploit Blind SQL Injection Bugs - Port Swigger

Summary: PortSwigger's article walks through exploiting a blind SQL injection bug found in an intentionally vulnerable training application, using Burp Intruder to cycle through pin numbers 0000-9999 and Grep-Match to spot the 'Account number is valid' response, which identified 2364 as the correct pin. It then describes escalating a database attack to command injection via Microsoft SQL Server's xp_cmdshell, which can be re-enabled with the sp_configure stored procedure when the web application's database account has sufficiently high privileges.
Key Takeaway: A single blind SQL injection can end in operating-system command execution through xp_cmdshell, so the privileges granted to a web application's database account determine whether a data breach stays a data breach.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026