Question

During a web application assessment, you confirm a SQL injection vulnerability in a Microsoft SQL Server backend. However, the application returns no error messages, no visible query output, and no measurable time delays when you inject boolean or time-based payloads. Outbound TCP to the internet is blocked, but the database server is permitted to make outbound DNS queries. Which technique is most appropriate to extract data from this database?

Accepted Answer

Trigger an out-of-band DNS exfiltration using xp_dirtree to a UNC path containing subqueried data

Answer

Use a UNION-based injection to append the target columns to the visible result set

Answer

Perform a heavy time-based blind extraction using WAITFOR DELAY on each character

Answer

Force verbose SQL error messages with a CAST conversion to leak data in the response body