Implement out-of-band for data fetching

[bdamele]

Recently we implemented DNS for data fetching. The objective is to implement more out-of-band techniques for data fetching:

• HTTP requests (Oracle UTL_HTTP)
• openrowset (to replicate dbms remotely on MSSQL)
• db_link() (to replicate dbms remotely on PgSQL)

Some relevant materials:

• http://www.hideaway.net/2007/08/out-of-band-oracle-sql-injection-with.html
• http://www.learnsecurityonline.com/offerings/videos/non-lso/165-defcon-15-t202-sql-injection-and-out-of-band-channeling

[marksteward]

openrowset is usually disabled by default these days. xp_dirtree might work for exfil, but it more likely to be blocked by firewalls.