> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/out-of-band.md).

# Out of band

Out-of-Band (OOB) SQL Injection is a type of SQL injection where the attacker receives data through a separate communication channel instead of the application's normal response.

Unlike Error-Based SQL Injection, which relies on database errors, or Blind SQL Injection, which relies on response content or timing differences, Out-of-Band SQL Injection uses external network interactions initiated by the database server.

This technique is typically used when the application does not display database errors, does not return useful query results, and is difficult to exploit using Boolean-Based or Time-Based techniques.

***

### Vulnerable PHP Code Example

```php
<?php

$conn = mysqli_connect("localhost", "root", "password", "shop");

$id = $_GET['id'];

$query = "SELECT * FROM products WHERE id = '$id'";

$result = mysqli_query($conn, $query);

while ($row = mysqli_fetch_assoc($result)) {
    echo $row['name'];
}

?>
```

***

### Code Explanation

The application retrieves the `id` parameter from the URL:

```php
$id = $_GET['id'];
```

The value is directly inserted into the SQL query:

```php
$query = "SELECT * FROM products WHERE id = '$id'";
```

Since user input is concatenated into the SQL statement without validation or parameterization, an attacker may be able to manipulate the query.

The application does not expose database errors and may not provide any useful feedback in its responses. However, if the database server is capable of making external network requests, the vulnerability may still be exploitable.

***

### How to Exploit

1. Identify a parameter that is used in a database query.
2. Determine whether user input influences the SQL statement.
3. Confirm that traditional techniques such as Error-Based, Boolean-Based, or Time-Based SQL Injection are ineffective or unreliable.
4. Investigate whether the database server can communicate with external systems through supported database features.
5. Cause the database server to generate an outbound network request.
6. Monitor the external system for incoming connections from the database server.
7. Use those external interactions to confirm the vulnerability and infer information about the database.
8. In certain situations, data may be transmitted through the external communication channel rather than through the application's normal response.

The success of this technique depends on the database platform, enabled database features, and whether outbound network access is permitted.