docker 安装 oracle数据库搭建sql注入环境 - 女黑客

sudo docker pull deepdiver/docker-oracle-xe-11g
docker run -d --name oracledb -p 1002:22 -p 1521:1521 deepdiver/docker-oracle-xe-11g

复制代码

docker exec -it oracledb /bin/bash

复制代码

sqlplus

复制代码

system/oracle

复制代码

select instance_name from v$instance;

复制代码

mvn install:install-file -DgroupId=com.oracle -DartifactId=ojdbc6 -Dversion=11.2.0.2.0 -Dpackaging=jar -Dfile=ojdbc6.jar

复制代码

<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%>
<%@ page import="oracle.jdbc.*"%>
<%@ page import="java.sql.*" %>
<%@ page import="oracle.sql.*" %>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>">
<title>Oracle注入测试</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css" mce_href="styles.css">
-->
</head>
<body>
<%
String url = "http://" + request.getServerName() + ":" + request.getServerPort() + request.getContextPath()+request.getServletPath();
Class.forName("oracle.jdbc.driver.OracleDriver").newInstance();
Statement stmt = null;
ResultSet rs=null;
String oraUrl="jdbc:oracle:thin:@192.168.100.10:1521:XE";
String oraUser="system";
String oraPWD="oracle";
try
{
DriverManager.registerDriver(new oracle.jdbc.driver.OracleDriver());
}catch (SQLException e)
{
response.getWriter().print("filed!!");
}
try
{
Connection conn=DriverManager.getConnection(oraUrl,oraUser,oraPWD);
String sql="select * from BIHUO."users" where "id"="+request.getParameter("id");
response.getWriter().print("执行语句:<br>"+sql+"<br>");
stmt = conn.createStatement();
rs = stmt.executeQuery(sql);
response.getWriter().print("结果为:");
response.getWriter().print("<table border='1' cellpadding='4' cellspacing='0' style='background-color:White;border-color:#3366CC;border-width:1px;border-style:None;width:203px;border-collapse:collapse;'>");
response.getWriter().print("<tr style='color:#CCCCFF;background-color:#003399;font-weight:bold;'>");
response.getWriter().print("<td>id</td><td>title</td><td>content</td>");
response.getWriter().print("</tr>");
response.getWriter().print("<tr style='color:#003399;background-color:White;'>");
while(rs.next())
{
response.getWriter().print("<td>");response.getWriter().print(rs.getString(1));response.getWriter().print("</td>");
response.getWriter().print("<td>");response.getWriter().print(rs.getString(2));response.getWriter().print("</td>");
response.getWriter().print("<td>");response.getWriter().print(rs.getString(3));response.getWriter().print("</td>");
}
response.getWriter().print("<tr>");
rs.close();
stmt.close();
conn.close();
} catch (SQLException e)
{
System.out.println(e.toString());
response.getWriter().print(e.toString());
}
%>
</body>
</html>

复制代码