Oracle Intro

This section provides a comprehensive collection of SQL injection techniques specific to Oracle databases.

Oracle Syntax Specifics

Unlike MySQL or PostgreSQL, Oracle has strict requirements for SELECT statements:

1. FROM Clause is Mandatory: Every SELECT statement must have a FROM clause.
2. DUAL Table: Use the DUAL dummy table when you need to select literals or call functions without a real table (e.g., SELECT 'A' FROM DUAL).
3. Concatenation: Use || for string concatenation (e.g., 'A'||'B'), not + (SQL Server) or space (MySQL).

The techniques are organized into the following categories:

Basics

Fundamental concepts and techniques for Oracle injection:

• Default Databases - Understanding and targeting Oracle’s default schemas and tablespaces
• Comment Out Query - Using Oracle comment syntax to modify queries
• Testing Version - Methods to determine Oracle database version

Information Gathering

Techniques to extract information from Oracle databases:

• Database Names - Retrieving available database names and schemas
• Server Hostname - Obtaining the Oracle server hostname
• Tables and Columns - Discovering table and column names
• Database Credentials - Techniques to extract Oracle credentials

Injection Techniques

Advanced methods for exploiting Oracle injection vulnerabilities:

• Avoiding Quotations - Bypassing quote filters in Oracle
• String Concatenation - Techniques to concatenate strings in Oracle
• Conditional Statements - Using CASE, DECODE, and other conditional expressions
• Timing - Time-based blind injection using Oracle-specific functions

Advanced Techniques

Sophisticated attacks for extracting data and gaining system access:

• Privileges - Determining and exploiting user privileges
• Out-of-Band Channeling - Extracting data using Oracle’s network capabilities
• Password Cracking - Techniques to recover passwords from Oracle hashes

Browse the techniques using the sidebar navigation or select a specific category to explore.