Hareeshwar N K | Security Research

Oct 30, 2026 · 6 min read

When the Database Talks Back: Blind SQLi Data Exfiltration Over DNS

A PortSwigger Practitioner lab where a quoted string literal blocked my first payload, and rebuilding the concatenation at SQL level turned the admin password into a DNS label.