mirror of
https://github.com/sqlmapproject/sqlmap.git
synced 2024-11-22 17:46:37 +03:00
added first Oracle test cases
This commit is contained in:
Bernardo Damele
parent
8a2b994b94
commit
3fa720e699
|
|
@ -49,7 +49,7 @@
|
|||
<item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29.+clear-text password: testpass'"/>
|
||||
<item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
|
||||
<item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
|
||||
<item value="r'Database: testdb.+3 tables.+users'"/>
|
||||
<item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
|
||||
<item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
|
||||
|
|
@ -93,7 +93,7 @@
|
|||
<item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
|
||||
<item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
|
||||
<item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
|
||||
<item value="r'Database: testdb.+3 tables.+users'"/>
|
||||
<item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
|
||||
<item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
|
||||
|
|
@ -137,7 +137,7 @@
|
|||
<item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
|
||||
<item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
|
||||
<item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
|
||||
<item value="r'Database: testdb.+3 tables.+users'"/>
|
||||
<item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
|
||||
<item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
|
||||
|
|
@ -181,7 +181,7 @@
|
|||
<item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
|
||||
<item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
|
||||
<item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
|
||||
<item value="r'Database: testdb.+3 tables.+users'"/>
|
||||
<item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
|
||||
<item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
|
||||
|
|
@ -239,7 +239,7 @@
|
|||
<item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
|
||||
<item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
|
||||
<item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
|
||||
<item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
|
||||
<item value="r'Database: testdb.+3 tables.+users'"/>
|
||||
<item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
|
||||
<item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
|
||||
|
|
@ -474,6 +474,239 @@
|
|||
<item value="r'Database: public.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="Oracle boolean-based multi-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/oracle/get_int.php?id=1"/>
|
||||
<threads value="4"/>
|
||||
<tech value="B"/>
|
||||
<extensiveFp value="True"/>
|
||||
<getBanner value="True"/>
|
||||
<getCurrentUser value="True"/>
|
||||
<getCurrentDb value="True"/>
|
||||
<getHostname value="True"/>
|
||||
<isDba value="True"/>
|
||||
<getUsers value="True"/>
|
||||
<getPasswordHashes value="True"/>
|
||||
<getPrivileges value="True"/>
|
||||
<getRoles value="True"/>
|
||||
<getDbs value="True"/>
|
||||
<getTables value="True"/>
|
||||
<getColumns value="True"/>
|
||||
<getCount value="True"/>
|
||||
<dumpTable value="True"/>
|
||||
<db value="scott"/>
|
||||
<tbl value="users"/>
|
||||
<excludeSysDbs value="True"/>
|
||||
</switches>
|
||||
<parse>
|
||||
<item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
|
||||
<item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
|
||||
<item value="banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
|
||||
<item value="current user: 'SYS'"/>
|
||||
<item value="current schema (equivalent to database on Oracle): 'SYS'"/>
|
||||
<item value="hostname: 'debian"/>
|
||||
<item value="current user is DBA: True"/>
|
||||
<item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
|
||||
<item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+clear-text password: CHANGE_ON_INSTALL.+SYS \[.+password hash: 2D5A0C491B634F1B.+clear-text password: TESTPASS'"/>
|
||||
<item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
|
||||
<item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
|
||||
<item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
|
||||
<item value="r'Database: SCOTT.+ tables.+USERS'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
|
||||
<item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="Oracle error-based multi-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/oracle/get_int.php?id=1"/>
|
||||
<threads value="4"/>
|
||||
<tech value="E"/>
|
||||
<extensiveFp value="True"/>
|
||||
<getBanner value="True"/>
|
||||
<getCurrentUser value="True"/>
|
||||
<getCurrentDb value="True"/>
|
||||
<getHostname value="True"/>
|
||||
<isDba value="True"/>
|
||||
<getUsers value="True"/>
|
||||
<getPasswordHashes value="True"/>
|
||||
<getPrivileges value="True"/>
|
||||
<getRoles value="True"/>
|
||||
<getDbs value="True"/>
|
||||
<getTables value="True"/>
|
||||
<getColumns value="True"/>
|
||||
<getCount value="True"/>
|
||||
<dumpTable value="True"/>
|
||||
<db value="scott"/>
|
||||
<tbl value="users"/>
|
||||
<excludeSysDbs value="True"/>
|
||||
<answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
|
||||
</switches>
|
||||
<parse>
|
||||
<item value="Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)"/>
|
||||
<item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
|
||||
<item value="banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
|
||||
<item value="current user: 'SYS'"/>
|
||||
<item value="current schema (equivalent to database on Oracle): 'SYS'"/>
|
||||
<item value="hostname: 'debian"/>
|
||||
<item value="current user is DBA: True"/>
|
||||
<item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
|
||||
<item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
|
||||
<item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
|
||||
<item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
|
||||
<item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
|
||||
<item value="r'Database: SCOTT.+ tables.+USERS'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
|
||||
<item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="Oracle UNION query multi-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/oracle/get_int.php?id=1"/>
|
||||
<threads value="4"/>
|
||||
<tech value="U"/>
|
||||
<extensiveFp value="True"/>
|
||||
<getBanner value="True"/>
|
||||
<getCurrentUser value="True"/>
|
||||
<getCurrentDb value="True"/>
|
||||
<getHostname value="True"/>
|
||||
<isDba value="True"/>
|
||||
<getUsers value="True"/>
|
||||
<getPasswordHashes value="True"/>
|
||||
<getPrivileges value="True"/>
|
||||
<getRoles value="True"/>
|
||||
<getDbs value="True"/>
|
||||
<getTables value="True"/>
|
||||
<getColumns value="True"/>
|
||||
<getCount value="True"/>
|
||||
<dumpTable value="True"/>
|
||||
<db value="scott"/>
|
||||
<tbl value="users"/>
|
||||
<excludeSysDbs value="True"/>
|
||||
<answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
|
||||
</switches>
|
||||
<parse>
|
||||
<item value="Title: Generic UNION query (NULL) - 3 columns"/>
|
||||
<item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
|
||||
<item value="banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
|
||||
<item value="current user: 'SYS'"/>
|
||||
<item value="current schema (equivalent to database on Oracle): 'SYS'"/>
|
||||
<item value="hostname: 'debian"/>
|
||||
<item value="current user is DBA: True"/>
|
||||
<item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
|
||||
<item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
|
||||
<item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
|
||||
<item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
|
||||
<item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
|
||||
<item value="r'Database: SCOTT.+ tables.+USERS'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
|
||||
<item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="Oracle partial UNION query multi-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/oracle/get_int_partialunion.php?id=1"/>
|
||||
<threads value="4"/>
|
||||
<tech value="U"/>
|
||||
<extensiveFp value="True"/>
|
||||
<getBanner value="True"/>
|
||||
<getCurrentUser value="True"/>
|
||||
<getCurrentDb value="True"/>
|
||||
<getHostname value="True"/>
|
||||
<isDba value="True"/>
|
||||
<getUsers value="True"/>
|
||||
<getPasswordHashes value="True"/>
|
||||
<getPrivileges value="True"/>
|
||||
<getRoles value="True"/>
|
||||
<getDbs value="True"/>
|
||||
<getTables value="True"/>
|
||||
<getColumns value="True"/>
|
||||
<getCount value="True"/>
|
||||
<dumpTable value="True"/>
|
||||
<db value="scott"/>
|
||||
<tbl value="users"/>
|
||||
<excludeSysDbs value="True"/>
|
||||
<answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
|
||||
</switches>
|
||||
<parse>
|
||||
<item value="Title: Generic UNION query (NULL) - 3 columns"/>
|
||||
<item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
|
||||
<item value="banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
|
||||
<item value="current user: 'SYS'"/>
|
||||
<item value="current schema (equivalent to database on Oracle): 'SYS'"/>
|
||||
<item value="hostname: 'debian"/>
|
||||
<item value="current user is DBA: True"/>
|
||||
<item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
|
||||
<item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
|
||||
<item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
|
||||
<item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
|
||||
<item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
|
||||
<item value="r'Database: SCOTT.+ tables.+USERS'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
|
||||
<item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="Oracle time-based single-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/oracle/get_int_nooutput.php?id=1"/>
|
||||
<tech value="T"/>
|
||||
<timeSec value="2"/>
|
||||
<getBanner value="True"/>
|
||||
<isDba value="True"/>
|
||||
</switches>
|
||||
<parse>
|
||||
<item value="Title: Oracle AND time-based blind"/>
|
||||
<item value="banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
|
||||
<item value="current user is DBA: True"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="Oracle inline queries multi-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/oracle/get_int_inline.php?id=1"/>
|
||||
<threads value="4"/>
|
||||
<tech value="Q"/>
|
||||
<extensiveFp value="True"/>
|
||||
<getBanner value="True"/>
|
||||
<getCurrentUser value="True"/>
|
||||
<getCurrentDb value="True"/>
|
||||
<getHostname value="True"/>
|
||||
<isDba value="True"/>
|
||||
<getUsers value="True"/>
|
||||
<getPasswordHashes value="True"/>
|
||||
<getPrivileges value="True"/>
|
||||
<getRoles value="True"/>
|
||||
<getDbs value="True"/>
|
||||
<getTables value="True"/>
|
||||
<getColumns value="True"/>
|
||||
<getCount value="True"/>
|
||||
<dumpTable value="True"/>
|
||||
<db value="scott"/>
|
||||
<tbl value="users"/>
|
||||
<excludeSysDbs value="True"/>
|
||||
<answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
|
||||
</switches>
|
||||
<parse>
|
||||
<item value="Title: Oracle inline queries"/>
|
||||
<item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
|
||||
<item value="banner: 'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
|
||||
<item value="current user: 'SYS'"/>
|
||||
<item value="current schema (equivalent to database on Oracle): 'SYS'"/>
|
||||
<item value="hostname: 'debian"/>
|
||||
<item value="current user is DBA: True"/>
|
||||
<item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
|
||||
<item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
|
||||
<item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
|
||||
<item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
|
||||
<item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
|
||||
<item value="r'Database: SCOTT.+ tables.+USERS'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
|
||||
<item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
|
||||
<item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
|
||||
</parse>
|
||||
</case>
|
||||
<case name="SQLite boolean-based multi-threaded enumeration - all entries">
|
||||
<switches>
|
||||
<url value="http://debiandev/sqlmap/sqlite/get_int.php?id=1"/>
|
||||
|
|
|
|||
Loading…
Reference in New Issue
Block a user