WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 10, 2026 • Session details

Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.

Fabiano Amorim

Can a standard user hijack your managed cloud database? See how abusing DDL triggers and un-sanitized T-SQL yielded full sysadmin rights across Azure, AWS, GCP, and Alibaba.

Pause
Mute Enter Fullscreen
#1 about 5 min

Identifying SQL injection vulnerabilities in internal stored procedures

Automating security checks reveals common flaws in complex internal queries where user input is unsafely concatenated.

#2 about 4 min

Validating SQL injection risks with a PowerShell module

A programmatic demonstration parses statements to pinpoint unsafe dynamic command concatenations and risks stemming from implicit data type conversions.

#3 about 5 min

Exploiting internal stored procedures to execute shell commands

System procedures inherently possess elevated privileges that attackers compromise to bypass execution restrictions and run operating system commands.

#4 about 3 min

Bypassing sysadmin restrictions across major cloud providers

Despite restrictive managed service guarantees, underlying architectural implementation flaws enable full privilege escalation across multiple cloud database environments.

#5 about 7 min

Exploiting managed instances on Azure and Alibaba Cloud

Bypassing weak internal mitigations and exploiting shared architectural environments exposes cross-tenant databases and plaintext system credentials.

#6 about 7 min

Hijacking administrative execution context using DDL event triggers

Malicious data definition triggers intercept automated administrative procedures to secretly elevate standard application users into elevated administrators.

#7 about 2 min

Hardening database environments through the principle of least privilege

Revoking default access to unneeded system capabilities proactively protects instances against chained privilege escalation attacks.

Matching moments

2:40 min

Examining real-world zero-day exploits in enterprise applications

Sonya Moisset · World Congress 2023

2:43 min

Understanding common web application vulnerabilities and risks

Jakub Andrzejewski · World Congress 2023

4:12 min

Exploiting cloud metadata servers and manipulating authentication tokens

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

2:55 min

Identifying common and emerging application injection attack vectors

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

2:40 min

Identifying command injection flaws in developer infrastructures

Vandana Verma Sehgal · LIVE

2:46 min

The risk of weak credentials in maintainer accounts

Vandana Verma Sehgal · LIVE

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
2 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
2 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
2 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
2 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
2 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
2 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 14:10–14:40

Stage 3

Hacking MSSQL on Cloud. All of them. How I became sysadmin on Azure, AWS, GCP and Alibaba.

Fabiano Amorim

Chief Technology Advisor at PowerTuning

Fabiano Amorim
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 24, 2026 · 16:50–17:20

Stage 2

It passed auth, then production caught fire

Alex Olivier

Co-founder & CPO @ Cerbos | OpenID AuthZEN Co-chair

Alex Olivier
Open session

World Congress 2026 North America

September 25, 2026 · 16:50–17:20

Stage 5

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer at Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

September 24, 2026 · 14:25–14:35

Outdoor Stage

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

September 24, 2026 · 17:30–18:00

Stage 5

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane

Related videos

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 6 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Checkmate: 5 Real Incidents That Can End a Software Company thumbnail
27:08
World Congress 2026 Europe • 2 months ago

Checkmate: 5 Real Incidents That Can End a Software Company

Jasmin Azemović

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • about 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most thumbnail
24:33
World Congress 2026 Europe • 2 months ago

The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most

Marcus Wermuth

Programming secure C#/.NET Applications: Dos & Don'ts thumbnail
33:29
World Congress 2024 • about 2 years ago

Programming secure C#/.NET Applications: Dos & Don'ts

Sebastian Leuer

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.