Question

I was reading an article about Sql injection in the article the author mentioned that if an sql injection attack has been performed the attacker can transfer an entire database over port 80 my question is how can you transfer your database over the http port is there any software to do it ? how can i protect myself over hijacking my database

http://msdn.microsoft.com/en-us/magazine/hh580736.aspx

Transfer an entire database over port 80

Answer 1

My guess is that if you got somewhere can be injected, then they can probably make it via following steps:

1. Backup the DB in SQL or script out all data into a file
2. Using some DBMS function copy that file to web server so that expose to internet, like xp_cmdshell in SQL Server
3. Download it via your web server