Blind SQL injection with out-of-band data exfiltration

The SQL query does not return any visible response, but it can trigger an out-of-band interaction that delivers the result through a separate channel or external server

For this lab activity, Burp Suite Pro will be needed since we will be making use of the Collaborator function

This is a Blind SQL injection wherein there is no response from the application from your query. However, the result can still be obtained through alternative methods, such as using an external server to receive the output of the query

This lab activity makes use of tracking cookies for analytics

Send the request of the website in its home page to Burp Suite Pro Repeater

Website request in its home page

Oracle

This website is not letting me paste the payload, that’s why it’s an image format

Highlight the “COLLABORATOR DOMAIN”, right click and select “Insert Collaborator Payload”, instead of manually copying and pasting the domain

URL encode (ctrl + u), then hit send

200 OK response

Since this is a Blind SQL Injection, that is the only response the website can do

Head on to Burp Collaborator, and click the “Poll now” button to reveal the requests received your server

DNS lookup of that certain tracking cookie

In the DNS lookup response, we can identify the source IP address it came from

Now that we’ve confirmed the website is vulnerable to DNS lookup and that your server is successfully receiving the requests, we can proceed with extracting data through it

Oracle

For this lab, it is stated that there is a “users” table with “username” and “password” columns, and we need to obtain the password for the “administrator” user

Highlight again the “COLLABORATOR DOMAIN”,right click then select the “Insert Collaborator Payload”, instead of manually copying and pasting the domain

URL encode (ctrl + u), then hit send

200 OK response

Again a 200 OK response, as this is a Blind SQL

Head on to Burp Collaborator

In Burp Collaborator, you’ll see the request appear again, and this time the password for the “administrator” user will be appended to the collaborator domain, separated by a dot (.)

This lab demonstrates blind SQL injection with out-of-band data exfiltration, where the application does not return visible query results but instead sends them externally through a separate channel using Burp Suite Pro’s Collaborator. The attack is carried out by injecting a Collaborator payload into a tracking cookie request, and sending it via Repeater, which returns a normal 200 OK response since no direct output is shown. DNS lookup requests reveal interactions from the target, including IP information and sensitive data containing the password of a certain user