New Exploits Target Microsoft SQL Server and SQL Injection Vulnerabilities

• •MSSQLand allows seamless exploitation of Microsoft SQL Server with minimal detection.
• •SQLMate automates the discovery of vulnerable sites and admin panels using SQL injection.
• •Both tools could be misused for malicious purposes, increasing the risk of exploitation.

Two new cybersecurity tools, MSSQLand and SQLMate, have been released targeting Microsoft SQL Server and SQL injection vulnerabilities respectively. MSSQLand is a post-exploitation tool designed for red team operators to navigate and exploit SQL Server environments with minimal detection. It allows for cascading impersonation and authentication using Windows tokens and pass-the-hash techniques. SQLMate, on the other hand, enhances SQLMap functionalities by automating the discovery of vulnerable sites and admin panels, and can crack various hash types quickly. Both tools are aimed at security professionals for penetration testing but could be misused by malicious actors. The release of these tools raises concerns about potential exploitation in the wild, especially given the capabilities they offer for bypassing security measures.