Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. The flaw sat in the application, where an autocomplete search field passed unvalidated input to the database over a Java Database Connectivity (JDBC) connection. Finding the toolkit means hunting: search the Oracle installation for object names beginning Khunt, and SQL logs for KHUNT%. Those indicators are specific to this toolkit, so no search for Khunt or KHUNT% will surface the technique behind it.