What is an out-of-band SQL injection attack?

The data leaves through a separate channel (DNS, email, an HTTP callback) rather than the response the attacker sent.

Out-of-band injection makes the application itself deliver the stolen data over a channel the attacker controls or can read, instead of over the HTTP response.

A worked example — a payment app whose /notification endpoint queues a confirmation e-mail:

1. The attacker posts a crafted transaction ID: transactionID = '1' UNION ALL SELECT USERNAME, PASSWORD, 0 FROM USERS--
2. The server answers 200 OK and shows nothing — the response looks completely normal.
3. Later, a nightly batch job renders the queued notification and sends an e-mail whose body now carries the grafted rows: the real transaction line, then bob, bob4cat, 0 and eve, even1n, 0.

Why an attacker chooses this: it works exactly where in-band fails — the application never echoes query results, so there is nothing to read in the response. Unlike blind injection, though, the attacker gets the data in bulk rather than one inferred bit at a time, so it is far faster when a suitable channel exists. DNS lookups and HTTP callbacks to an attacker-controlled host are the other classic carriers.

Detection consequence: monitoring only what the server returns will never see this. The evidence is in outbound traffic — unexpected mail, or DNS queries for attacker-owned domains.

Go deeper:

• PortSwigger — blind SQL injection with out-of-band data exfiltration — a hands-on lab exfiltrating over DNS.