> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/sql-injection/lab-12.md). # Lab 12 This is the next escalation when even time-based blind injection won't work. The scenario described: the app fires the SQL query on a separate async thread and immediately returns its response without waiting for the query to finish. So whether your injected condition is true or false, the HTTP response comes back at the same speed — there's no timing signal to read anymore, because the response was never coupled to the query's execution time in the first place. ### What is OAST? Out-of-band application security testing (OAST) uses external servers to see otherwise invisible vulnerabilities. {% hint style="info" %} At a high level: you're forcing their server to reach out and "call" infrastructure you control, and you just sit there watching your own logs to see if/when/what that call looked like. {% endhint %}