Fabiano Amorim

Real-world SQL Server attacks rarely follow textbook patterns – and many environments remain vulnerable to non-obvious privilege escalation paths that bypass typical security assumptions.

SQL Server environments are often assumed to be secure by default. This session challenges that assumption. Starting from a low-privileged SQL login, I will demonstrate how design decisions, legacy features, and overlooked behaviors inside the MSSQL engine can be combined to achieve full...

In this session we'll explore some of the many performance features included on SQL2022 and SQL2025. We'll see not only the good benefits of the features that work fine on AdventureWorks, but also some important considerations, limitations and potential improvements on the features.

It started as a simple security research project on a local SQL Server instance. A single vulnerability led me down a rabbit hole — from compromising Azure SQL Database to successfully escalating privileges on GCP CloudSQL for SQL Server, Amazon RDS, and Alibaba ApsaraDB.

Tudo começou como um projeto de pesquisa de segurança em uma instância local do SQL Server. Uma vulnerabilidade me levou a uma série de descobertas — desde comprometer o Azure SQL Database até conseguir escalar privilégios no GCP CloudSQL, Amazon RDS e Alibaba ApsaraDB.

Query plan compilation and optimization are known to be CPU-intensive operations; therefore, SQL Server will attempt to reuse cached execution plans wherever possible. Not having to compile (or recompile) and optimize a statement reduces the overhead on the server and speeds up overall performance.

The intelligent query processing (IQP) feature family includes features with broad impact that improve the performance of existing workloads with minimal implementation effort to adopt. In this session we'll explore the the many features that comprise IQP.

In this session, I'll talk about a collection of best practice scripts I've created to review the statistics used in a SQL Server environment when query execution times are slow.

SQL Server 2022 is the newest version of Microsoft's flagship RDBMS and many new features were improved and introduced. For DBAs, it is essential to understand these new features and how they can benefit their organizations.

In this session, I'll talk about a collection of best practice scripts I've created to review the statistics used in a SQL Server environment when query execution times are slow.

The intelligent query processing (IQP) feature family includes features with broad impact that improve the performance of existing workloads with minimal implementation effort to adopt. In this session we'll explore the the many features that comprise IQP.