ORACLE SQL Injection Cheat Sheet - Yorumlar

harsh

harsh — Çar, 10 Mar 2010 13:27:41 +0200

jhello...this is geat expierence /......

rem7ter

rem7ter — Cmt, 22 Kas 2008 08:43:02 +0200

thanks!but not sure that is useful

Deep Power

Deep Power — Per, 16 Eki 2008 16:51:49 +0200

Ferruh abi iyi güzel de ingilizce.Ingilizcem o kadar iyi degildir.En iyisi sen bunu tr ye çevir.Bir lise ogrencisi için zor : )
Selametle...

Ferruh Mavituna

Ferruh Mavituna — Sal, 02 Eki 2007 23:42:22 +0200

Alexandar,
Thanks for your comments. I'm quite new in ORACLE stuff. I updated current list according to your comments.

Alexander Kornbrust

Alexander Kornbrust — Sal, 02 Eki 2007 22:18:19 +0200

Nice list but some of the statements are too complicated:

e.g.
SELECT username, FROM all_users UNION SELECT name, password FROM sys.user$
better: SELECT name, password FROM sys.user$ where type#=1

or
use httpuritype instead of utl_http. utl_http is often removed from public. httpuritype works also and is not flagged by IDS:
SELECT HTTPURITYPE('http://www.red-database-security.com').getXML() FROM DUAL;