[gogreendv]

I have seen such a setting before and have tried it.
However, DNS was soon blocked.
Perhaps the firewall is strong.

[gogreendv]

Can anyone discuss this issue further?

[Mr.Kurd]

Well, While SQL injection most of time encoding and chnaging the structure of Union Select or the SQL statement works.

As mothered said you have to figure out the nature of the Firewall, its type and how it works.

[mothered]

Can anyone discuss this issue further?

It's not possible to provide conclusive answers based on a generalized question.

Every firewall Is configured differently to some degree, hence research Is of the utmost Importance prior to moving forward.

[taylostolo]

Perhaps the firewall is strong.

Sounds to me you have not even tried seeing how the fire wall is set up or possibly dont even know how? their is a ton of programs out their to do as such do the work and come back here and then your general question that is not easy to answer with the info you gave actually has something to work with or everyone that trys to help with what we got is shooting in the air.

[gogreendv]

Can anyone discuss this issue further?

It's not possible to provide conclusive answers based on a generalized question.

Every firewall Is configured differently to some degree, hence research Is of the utmost Importance prior to moving forward.

It's true.
I must bypass it without knowing configurations.

[mothered]

Can anyone discuss this issue further?

It's not possible to provide conclusive answers based on a generalized question.

Every firewall Is configured differently to some degree, hence research Is of the utmost Importance prior to moving forward.

It's true.
I must bypass it without knowing configurations.

It's pretty difficult to bypass It, when you don't know what you're dealing with.

You need to Identify the type of security rules In place, whether data sanitization (to prevent malicious requests) has been Implemented, the nature of the error messages returned, packet filtering (If any) and the list goes on. This Is just a minority, but It can significantly help to circumvent the firewall.

[gogreendv]

It's not possible to provide conclusive answers based on a generalized question.

Every firewall Is configured differently to some degree, hence research Is of the utmost Importance prior to moving forward.

It's true.
I must bypass it without knowing configurations.

It's pretty difficult to bypass It, when you don't know what you're dealing with.

You need to Identify the type of security rules In place, whether data sanitization (to prevent malicious requests) has been Implemented, the nature of the error messages returned, packet filtering (If any) and the list goes on. This Is just a minority, but It can significantly help to circumvent the firewall.

Thank you for your kindness.
You are right.

[mothered]

It's true.
I must bypass it without knowing configurations.

It's pretty difficult to bypass It, when you don't know what you're dealing with.

You need to Identify the type of security rules In place, whether data sanitization (to prevent malicious requests) has been Implemented, the nature of the error messages returned, packet filtering (If any) and the list goes on. This Is just a minority, but It can significantly help to circumvent the firewall.

Thank you for your kindness.

You're very welcome.

[gogreendv]

It really depends on how the firewall is configured, but most of them allow HTTP/HTTPS traffic as well as DNS. Therefore, you could just use a HTTP shell and exfiltrate data through DNS. ( these are just some ideas solutions you can come with, but as mentioned before it really depends on the system you're attacking )

That's good idea.
However, the DNS protocol can also be limited in data size.

This is not really a problem since you can send multiple packets and then reassemble the data. I think the more important aspect of it is to be stealthy, and this can be accomplished by not sending all the data you wan to exfiltrate at once. Just send 2-5 packets once in 5 hours or something like that. Probably you would know better since, again, this depends on your environment.
Regarding exfiltration you could also use pastebin API or other similar websites, but this might raise some suspicion.

Oh and if you are currently attacking a website without permission, just be careful. Things like that can take away some years of your live and completely redirect the normal path of your current live, so don't do anything stupid. I don't think it's worth it after all.

Regardless, good luck and be cautious

I would like to meet and talk with you at discord.