SQL Injection Cookbook - Oracle - Revision history

Davidribyrne@yahoo.com at 01:07, 17 January 2007

2007-01-17T01:07:03Z

Show changes

Davidribyrne@yahoo.com at 01:04, 17 January 2007

2007-01-17T01:04:29Z

Davidribyrne@yahoo.com: /* Set operators */

2007-01-14T21:04:48Z

‎Set operators

Davidribyrne@yahoo.com: /* SQL Tautologies */

2007-01-14T21:01:50Z

‎SQL Tautologies

Davidribyrne@yahoo.com: /* SQL Tautologies */

2007-01-14T07:42:25Z

‎SQL Tautologies

Davidribyrne@yahoo.com: /* String concatenation */

2007-01-14T07:40:08Z

‎String concatenation

Davidribyrne@yahoo.com at 07:39, 14 January 2007

2007-01-14T07:39:25Z

New page

__TOC__
=Database objects=
==Tables==
===List table names===
===Create a table===
===List columns for a specific table===
===View table permissions===
===Change table permissions===

==Stored procedures or functions==
===List stored procedures or functions===
===Parameters for a stored procedure or function===
===Source code of a stored procedure or function===
===Create a stored procedure or function===

=System data=
==Users==
===Identify current user===
===List of database users===
===List of database administrators===
===Database user permissions===
===Create a new user===
===Change a user password===
===Delete a user===

==Database server==
===View database server settings===
===Change database server settings===
===View database server processes===
===Kill database server process===

==Host Operating System==
===Operating System version===
===OS environment variables===
===Execute OS shell commands===
===Read file contents===
===Arbitrary file writes===
===File uploads===

=Unique database platform features=

=Queries=
==Strings==
===Valid string delimiters===
===String concatenation===
String concatenation is performed by a double pipe.
SELECT
FirstName || ' ' || LastName
FROM
People
===String-based queries with no quote characters===

==Query syntax==
===Acceptable whitespace===
===Tableless queries===
Tableless queries aren’t supported in Oracle per se. However, a special table named "Dual" allows for similar functionality. This doesn't help much for filter evasion since it still matches the standard SELECT syntax.
SELECT
'This is a string'
FROM
Dual
===Query comments===
===Query command delimiters===
===Set operators===
Set operators are used to combine the results from two different queries. The number of columns and order of column types must be identical for both queries. The general syntax is

SELECT
fname, lname
FROM
employees
'''''SET_OPERATOR'''''
SELECT
fname, lname
FROM
customers
====UNION====
Returns the rows from both queries, removing duplicates

====UNION ALL====
Returns the rows from both queries, duplicates are not removed.

====INTERSECT====
Returns the rows that are found in the results of both queries.

====MINUS====
Returns only the rows in the first query that are not found in the second query.

==Special queries==
===Single column queries===
===Single row queries===

==Functions, etc.==
===Data type casting===
===Query output to file===

=Attacks=
==Breaking out of a query==
===WHERE clauses===
===FROM clauses===
===Other parts of a SELECT===
===INSERT statements===
===UPDATE statements===

==Timing attacks==
==SQL Tautologies==
A tautology is something that is inherently true. SQL tautologies are used when you want to force a query to return all results, basically ignoring any WHERE conditionals. Simple tautologies like " OR 1=1" are useful, but may be filtered out by some security tools. The table below offers a number of tautologies that filter writers (even on well known commercial tools) may not have considered.

{| style="width:50%;" border="1" cellspacing="0" cellpadding="5"
! Statement
! Numeric
(1 = 1)
! String
('a' = 'a')
! Binary
(0x1 = 0x1)
|-
| '''''a''''' = '''''a'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' ^= '''''b'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' < '''''b'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''b''''' > '''''a'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' <= '''''b'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''b''''' >= '''''a'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' <! '''''b'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''b''''' >! '''''a'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' ''operator'' ANY ('''''a''''', '''''b''''', '''''c''''', '''''d''''')
where ''operator ''is any of the
first 9 listed comparison
operators; for the statement to
be true, the operator must return
true for '''''a''''' and least one of the
items in the list
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' ''operator'' SOME ('''''a''''', '''''b''''', '''''c''''', '''''d''''')
SOME is '''''a''''' synonym of ANY
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' ''operator ''ALL ('''''a''''', '''''b''''', '''''c''''', '''''d''''')
similar to ANY, except that the
operator must return true for '''''a'''''
and all of the items in the list
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' IN ('''''c''''', '''''b''''', '''''a''''')
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' NOT IN (d, '''''c''''', '''''b''''')
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''b''''' BETWEEN '''''a''''' AND '''''c'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' NOT BETWEEN '''''c''''' AND '''''d'''''
| align="center" | X
| align="center" | X
| align="center" | X
|-
| '''''a''''' LIKE '''''a'''''
|
| align="center" | X
|
|-
| '''''a''''' NOT LIKE '''''b'''''
|
| align="center" | X
|
|}

=Data exfiltration=
==E-mail==
==Web==
==General network==

@@ Line 49: / Line 49: @@
 String concatenation is performed by a double pipe ('''||''').
    SELECT
-  FirstName || ' ' || LastName
+     FirstName || ' ' || LastName
    FROM
       People
@@ Line 78: / Line 78: @@
       customers
-====UNION====
+'''UNION'''<br>
 Returns the rows from both queries, removing duplicates
+<br>
-====UNION ALL====
+'''UNION ALL'''<br>
 Returns the rows from both queries, duplicates are not removed.
+<br>
 ====INTERSECT====
 Returns the rows that are found in the results of both queries.

@@ Line 110: / Line 110: @@
 {| style="width:75%;" border="1" cellspacing="0" cellpadding="5"
-! Statement
+! width="55%"|Statement
-! Numeric
+! width="15%"|Numeric
 (1 = 1)
-! String
+! width="15%"|String
 ('a' = 'a')
-! Binary
+! width="15%"|Binary
 (0x1 = 0x1)
 |-
@@ Line 170: / Line 170: @@
 |-
 | '''''a''''' ''operator'' SOME ('''''a''''', '''''b''''', '''''c''''', '''''d''''')
-SOME is '''''a''''' synonym of ANY
+SOME is a synonym of ANY
 | align="center" | X
 | align="center" | X
@@ Line 188: / Line 188: @@
 | align="center" | X
 |-
-| '''''a''''' NOT IN (d, '''''c''''', '''''b''''')
+| '''''a''''' NOT IN ('''''d''''', '''''c''''', '''''b''''')
 | align="center" | X
 | align="center" | X
@@ Line 204: / Line 204: @@
 |-
 | '''''a''''' LIKE '''''a'''''
+| &nbsp;
 | align="center" | X
+| &nbsp;
 |-
 | '''''a''''' NOT LIKE '''''b'''''
+| &nbsp;
 | align="center" | X
+| &nbsp;
 |}

@@ Line 109: / Line 109: @@
 A tautology is something that is inherently true. SQL tautologies are used when you want to force a query to return all results, basically ignoring any WHERE conditionals. Simple tautologies like " OR 1=1" are useful, but may be filtered out by some security tools. The table below offers a number of tautologies that filter writers (even on well known commercial tools) may not have considered.
-{| style="width:50%;" border="1" cellspacing="0" cellpadding="5"
+{| style="width:75%;" border="1" cellspacing="0" cellpadding="5"
 ! Statement
 ! Numeric
@@ Line 213: / Line 213: @@
+|
 |}
 =Data exfiltration=

@@ Line 47: / Line 47: @@
 ===Valid string delimiters===
 ===String concatenation===
-String concatenation is performed by a double pipe.
+String concatenation is performed by a double pipe ('''||''').
    SELECT
       FirstName || ' ' || LastName
    FROM
       People
 ===String-based queries with no quote characters===