Skip to content

Oracle SQLi Column Name Enumeration Miss-Written Payload #163

Open
@papq1

Description

@papq1

Hi @LasCC big appreciation for this wonderful extension.

Today I came across on a miss-written payload, which could cause people using the extension miss a valid SQLi attack.
It has to do with the oracle database section, more specifically 'Column Name Enumeration' payload which does not specify the all_tab_columns table as part for the SQLi.

image

The corrected version should be: "'UNION SELECT column_name,NULL FROM all_tab_columns where table_name="X" -- -"

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions