This paper describes an advanced SQL injection technique where DNS resolution process is exploited for retrieval of malicious SQL query results. Resulting DNS requests are intercepted by attackers themselves at the controlled remote name server extracting valuable data. Open source SQL injection tool sqlmap has been adjusted to automate this task. With modifications done, attackers are able to use this technique for fast and low profile data retrieval, especially in cases where other standard ones fail.

翻译：本文描述了一种先进的 SQL 注入技术, 即利用 DNS 解析程序检索恶意 SQL 查询结果。 由此产生的 DNS 请求被攻击者自己在受控的远程服务器上拦截, 提取有价值的数据。 开放源 SQL 注入工具 sqlmap 已经调整, 以使这项任务自动化。 修改完成后, 攻击者能够使用这一技术快速和低配置数据检索, 特别是在其他标准数据失效的情况下。