Exam 312-50v13 topic 1 question 88 discussion

Correct: C - Out-of-band... Server executes commands injected into SQL, that instructs the server, for example, to make connection to some specified domain, so the server makes DNS query to resolve the domain and tries to connect to the destination. The DNS communication usually goes via some backend management or inside network, which is out of band (scope) of the network via the attacker's query came to the server (via public front end web interface). To find out if this out-of-band communication from the server is happening and reaching the Internet, the attacker registers specific domain (used in the SQL injection) and listens for DNS resolutions on its Authoritative DNS server. If DNS query comes from the attacked server, the server is executing injected commands. BurpSuite Professional (i. e. paid version) has feature Collaborator, which automates creation the domain for the pentester and checking of incoming connections.