sa
with a blank password.hsqldb/lib/hsqldb.jar
. Run the GUI app (eww) using java -jar hsqldb.jar
and connect to the instance using the discovered/weak credentials.jdbc:hsqldb:hsql://ip/DBNAME
.functions
or procedures
. Functions can be called via SQL statements if the Java method returns one or more SQL-compatible primitive variables. They are invoked using the VALUES
statement.CALL
statement.com.sun.org.apache.xml.internal.security.utils.JavaUtils.writeBytesToFilename
Java gadget located in the JDK (auto loaded into the class path of the application) to write hex-encoded items to disk via a custom procedure. Note the maximum size of 1024 bytes.