Post
SQL Server 2019 and 2022 have introduced default lockdowns that break older tools. Specifically:
The new SQLninja package addresses these head-on with two new flags:
| Flag | Purpose |
|------|---------|
| --no-sp-configure | Avoids touching sp_configure (uses alternative methods like sp_OACreate or exec master..xp_regread to test command execution) |
| --trace-sleep | Injects WAITFOR DELAY only when no error log inflates – evades SIEM rules looking for long-running queries |
These are not just fixes; they are feature upgrades that keep SQLninja relevant for greenfield MSSQL pentests.
If you look under the hood, the maintainers have migrated the codebase from a monolithic Perl script to a modular architecture.
git clone https://github.com/sqlninja/sqlninja.git
cd sqlninja
perl Makefile.PL
make
sudo make install