Scenario There are many articles about SQLis but I’m writing this with the aim of a Windows server and MS SQL server specifically. Most of this can be applied to other environments too. Let’s suppose that you’ve found an SQL injection vulnerability on a page that has a GET parameter called “item” and that shows the details of a single item. Then you might be wondering how could I exploit it. The url looks something like: Code: Details.aspx?item=1 Injection Let’s assume that in the database there is a table with 5 columns: id (integer, row id), data (text), name (text), priority(integer) and private (bool). Then in the application, one could (but shouldn't) write an SQL query like: Code: "select id, data, name, priority, private from Example where id = " + Request["item"] + " and private = 0” Now if a malicious user enters something nasty, like Code: Details.aspx?item=0 or 1=1-- then, the query will return all rows from the ta...