title: How does Burp Collaborator send a DNS query via Sql Server and T-sql
body: <p>How can Burp Collaborator send a DNS query via t-sql and Sql Server?</p>
  
  <p><a href="https://portswigger.net/burp/help/collaborator.html" rel="nofollow noreferrer">https://portswigger.net/burp/help/collaborator.html</a></p>
  
  <p>I know you can use for example <code>exec master..xp_cmdshell 'nslookup intel.com'</code> or <code>Dns.GetHostAddresses()</code> in a stored procedure on SQL Server 2005 or 2008 as mentioned here: <a href="https://stackoverflow.com/a/967696/3850405">https://stackoverflow.com/a/967696/3850405</a></p>
  
  <p>However not many servers allow <code>xp_cmdshell</code> today, rightfully so, but this means that Burp Collaborator uses something else. What? The connection only has to be outbound, nothing needs to be returned.  </p>