Recently we implemented DNS for data fetching. The objective is to implement more out-of-band techniques for data fetching: - HTTP requests (Oracle UTL_HTTP) - openrowset (to replicate dbms remotely on MSSQL) - db_link() (to replicate dbms remotely on PgSQL) Some relevant materials: - http://www.hideaway.net/2007/08/out-of-band-oracle-sql-injection-with.html - http://www.learnsecurityonline.com/offerings/videos/non-lso/165-defcon-15-t202-sql-injection-and-out-of-band-channeling
Activity
marksteward commentedon Sep 12, 2019
openrowset is usually disabled by default these days. xp_dirtree might work for exfil, but it more likely to be blocked by firewalls.
Thanioner commentedon Dec 7, 2022
amigo me interesa este proyecte actualiza tiene muchas fallas por favor dramirezr1487@gmail.com valoro el trabajo de los demás eres un crack