Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The proof arrives outside the HTTP response: the in-band response is unchanged, but EXTRACTVALUE(xmltype(… SYSTEM “http://COLLAB/“ …),’/l’) FROM dual causes a Collaborator DNS interaction. Oracle XML processing resolves the external system identifier and leaves a DNS event in Collaborator.

Lab objective/setup

Exercise Blind SQL injection with out-of-band interaction through the endpoint and input recorded in the lab note. The in-band response is unchanged, but EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual causes a Collaborator DNS interaction.

What I observed

the in-band response is unchanged, but EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual causes a Collaborator DNS interaction.

The in-band response is unchanged, but `EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual` causes a Collaborator DNS interaction.
The in-band response is unchanged, but `EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual` causes a Collaborator DNS interaction.

Why it is vulnerable

The in-band response is unchanged, but EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual causes a Collaborator DNS interaction. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Generate a unique Collaborator address, embed it as the external entity system URL in the Oracle expression, and place that expression in the injectable TrackingId. Poll for the DNS lookup; the interaction, rather than page content, is the success signal.

Repeater injects an Oracle EXTRACTVALUE XML external entity with a unique Collaborator URL into the TrackingId cookie while the HTTP response remains unchanged.
Repeater injects an Oracle EXTRACTVALUE XML external entity with a unique Collaborator URL into the TrackingId cookie while the HTTP response remains unchanged.
Collaborator polling displays the resulting DNS interaction from the lab database host, confirming out-of-band execution of the TrackingId query.
Collaborator polling displays the resulting DNS interaction from the lab database host, confirming out-of-band execution of the TrackingId query.

Verification

The lab is confirmed when the in-band response is unchanged, but EXTRACTVALUE(xmltype(... SYSTEM "http://COLLAB/" ...),'/l') FROM dual causes a Collaborator DNS interaction. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

Blind injection can still be confirmed through database egress. Combine parameterized SQL with outbound DNS/HTTP restrictions and monitoring for XML functions that reference external hosts.

References