On Sun, Feb 8, 2009 at 6:16 PM, Roman Medina-Heigl Hernandez <roman@xxxxxxxxxxx> wrote: > Razi Shaban escribió: >>> I am glad to release SFX-SQLi (Select For XML SQL injection), a new SQL >>> injection technique which allows to extract the whole information of a >>> Microsoft SQL Server 2005/2008 database in an extremely fast and efficient >>> way. >> >> This isn't new, this is old news. It might be the first paper written >> about the topic, but these methods have been used for years. > > Please, Razi, could you name any reference? I suppose that if the method is > well-known, as you're suggesting, it shouldn't be difficult at all to find > at least one. I can't believe no tool is implementing such a great idea, if > it is "old news". > > -- > > Saludos, > -Roman Not reference, not white paper, not tool. I am talking about the real internet, where things aren't talked about but actually happen. Hackers have been using methods similar to this for years, it's about time a white-hat discovered this. Regards, Razi Shaban
