The command xp_cmdshell executes system-level commands from SQL Server. The command whoami /all is used to enumerate user privileges, group memberships, and security contexts on Windows systems.
From the CompTIA PenTest+ PT0-003 Official Study Guide (Chapter 8 – Post-Exploitation Techniques):
“Using xp_cmdshell and system commands like whoami /all allows testers to identify the privilege level of the database user and system access level.”
[Reference: Chapter 8, CompTIA PenTest+ PT0-003 Official Study Guide, , , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit