DNS exfiltration attack

[fabianlagos]

What's the problem (or question)?

Is it possible to list information only with the DNS exfiltration attack technique?

I have a possible injection to a mssql 2016 but only for the DNS interaction technique. But not if it is possible to enumerate information from the database

Do you have an idea for a solution?

No idea.

What are the running context details?

• Installation method (e.g. pip, apt-get, git clone or zip/tar.gz):
• Client OS (e.g. Microsoft Windows 10)
• Program version (python sqlmap.py --version or sqlmap --version depending on installation):
• Target DBMS: Microsoft SQL Server 2016
• SQLi techniques found by sqlmap: Out-of-band (DNS) SQL
• Results of manual target assessment (e.g. found that the payload query=test' AND 4113 IN ((SELECT 'foobar'))-- qKLV works):

[stamparm]

1. Can you please explain what does it mean But not if it is possible to enumerate information from the database?
2. If not even "time-based" SQLi works, I am pretty sure that DNS exfiltration won't work
3. You might try hidden option/switch --force-dns. Not sure that it is something that you need, but that same option/switch would force usage of DNS exfiltration (if SQLi has been detected in the first place) even if some other (faster) technique is available

[stamparm]

ping?

[fabianlagos]

Hi stamparm,

1. The scanner detects an SQLi only with the Out-of-Band DNS technique and with this technique it is not possible to enumerate information with the SQLMAP.
2. This is the clarification I needed. Can you detail me because it is not possible only with the OOB DNS technique?

Thank you very much for the help, regards

[stamparm]

In sqlmap DNS exfiltration is used ONLY for OOB, not for testing. This means that, as said previously, at least one other technique has to be usable (e.g. in vast majority of SQLi cases at least time-based or boolean-based blind SQLi is/are available).

Design decision that won't change. There is something really wrong with your case if DNS OOB works, while time-based and/or boolean doesn't work.

If you really want to support such case of yours, I would suggest you to make your own manual payloads, while running sqlmap's lib/request/dns.py from command line as a standalone - it will give you the response as a console output