Other Open Access

A Study of Out-of-Band Structured Query Language Injection

Lee Chun How


DataCite XML Export

<?xml version='1.0' encoding='utf-8'?>
<resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://datacite.org/schema/kernel-4" xsi:schemaLocation="http://datacite.org/schema/kernel-4 http://schema.datacite.org/meta/kernel-4.1/metadata.xsd">
  <identifier identifierType="DOI">10.5281/zenodo.3556347</identifier>
  <creators>
    <creator>
      <creatorName>Lee Chun How</creatorName>
      <nameIdentifier nameIdentifierScheme="ORCID" schemeURI="http://orcid.org/">0000-0002-5288-6136</nameIdentifier>
    </creator>
  </creators>
  <titles>
    <title>A Study of Out-of-Band Structured Query Language Injection</title>
  </titles>
  <publisher>Zenodo</publisher>
  <publicationYear>2019</publicationYear>
  <subjects>
    <subject>SQL Injection</subject>
    <subject>Out-of-Band</subject>
    <subject>Input Validation</subject>
    <subject>DNS</subject>
    <subject>HTTP</subject>
  </subjects>
  <dates>
    <date dateType="Issued">2019-08-23</date>
  </dates>
  <resourceType resourceTypeGeneral="Text">Other</resourceType>
  <alternateIdentifiers>
    <alternateIdentifier alternateIdentifierType="url">https://zenodo.org/record/3556347</alternateIdentifier>
  </alternateIdentifiers>
  <relatedIdentifiers>
    <relatedIdentifier relatedIdentifierType="DOI" relationType="IsVersionOf">10.5281/zenodo.3556346</relatedIdentifier>
  </relatedIdentifiers>
  <rightsList>
    <rights rightsURI="https://creativecommons.org/licenses/by/4.0/legalcode">Creative Commons Attribution 4.0 International</rights>
    <rights rightsURI="info:eu-repo/semantics/openAccess">Open Access</rights>
  </rightsList>
  <descriptions>
    <description descriptionType="Abstract">&lt;p&gt;Out-of-Band (OOB) Structured Query Language (SQL) Injection is an exploitation to exfiltrate data from database through different outbound channel. Common channel use by OOB SQL Injection for data exfiltration are through Domain Name Server (DNS) and HyperText Transfer Protocol (HTTP) channels. This type of SQL injection should address properly due to the impact is on the par with traditional methods. OOB SQL Injection impacts on database systems with insufficient of input validation control in place and allowed access to public, either DNS or HTTP protocol. Test cases and recommendation for remediation have been discussed in this paper in order to raise awareness of the exploitation.&lt;/p&gt;</description>
  </descriptions>
</resource>
388
1,037
views
downloads
All versions This version
Views 388382
Downloads 1,0371,033
Data volume 480.7 MB478.9 MB
Unique views 353347
Unique downloads 972969

Share

Cite as