Description

bdamele

opened on Jun 26, 2012

Issue body actions

Recently we implemented DNS for data fetching. The objective is to implement more out-of-band techniques for data fetching:

• HTTP requests (Oracle UTL_HTTP)
• openrowset (to replicate dbms remotely on MSSQL)
• db_link() (to replicate dbms remotely on PgSQL)

Some relevant materials:

• http://www.hideaway.net/2007/08/out-of-band-oracle-sql-injection-with.html
• http://www.learnsecurityonline.com/offerings/videos/non-lso/165-defcon-15-t202-sql-injection-and-out-of-band-channeling

Activity

1. ghost assigned

   stamparm

   on Jun 26, 2012
2. marksteward commented on Sep 12, 2019

   

   marksteward

   on Sep 12, 2019

   More actions

   openrowset is usually disabled by default these days. xp_dirtree might work for exfil, but it more likely to be blocked by firewalls.
3. Thanioner commented on Dec 7, 2022

   

   Thanioner

   on Dec 7, 2022

   More actions

   amigo me interesa este proyecte actualiza tiene muchas fallas por favor [email protected] valoro el trabajo de los demás eres un crack

   Reacted by Thanioner

Issue actions