From 3fa720e699f5f270516b0ce2b7ae0ac1c4e0f957 Mon Sep 17 00:00:00 2001
From: Bernardo Damele <bernardo.damele@gmail.com>
Date: Mon, 14 Jan 2013 17:30:42 +0000
Subject: [PATCH] added first Oracle test cases

---
 xml/livetests.xml | 243 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 238 insertions(+), 5 deletions(-)

diff --git a/xml/livetests.xml b/xml/livetests.xml
index 548bacf65..21015e621 100644
--- a/xml/livetests.xml
+++ b/xml/livetests.xml
@@ -49,7 +49,7 @@
             <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29.+clear-text password: testpass'"/>
             <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
             <item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
-            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
+            <item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
             <item value="r'Database: testdb.+3 tables.+users'"/>
             <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
             <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
@@ -93,7 +93,7 @@
             <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
             <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
             <item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
-            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
+            <item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
             <item value="r'Database: testdb.+3 tables.+users'"/>
             <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
             <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
@@ -137,7 +137,7 @@
             <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
             <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
             <item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
-            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
+            <item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
             <item value="r'Database: testdb.+3 tables.+users'"/>
             <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
             <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
@@ -181,7 +181,7 @@
             <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
             <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
             <item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
-            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
+            <item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
             <item value="r'Database: testdb.+3 tables.+users'"/>
             <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
             <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
@@ -239,7 +239,7 @@
             <item value="r'database management system users password hashes:.+root \[.+password hash: \*00E247AC5F9AF26AE0194B41E1E769DEE1429A29'"/>
             <item value="r'database management system users privileges:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+privilege: SUPER'"/>
             <item value="r'database management system users roles:.+debian-sys-maint.+\(administrator\).+root.+\(administrator\).+role: SUPER'"/>
-            <item value="r'available databases \[.+information_schema.+mysql.+owasp10.+testdb'"/>
+            <item value="r'available databases \[.+information_schema.+mysql.+testdb'"/>
             <item value="r'Database: testdb.+3 tables.+users'"/>
             <item value="r'Database: testdb.+Table: users.+3 columns.+surname.+varchar\(1000\)'"/>
             <item value="r'Database: testdb.+Table.+Entries.+users.+5'"/>
@@ -474,6 +474,239 @@
             <item value="r'Database: public.+Table: users.+5 entries.+luther.+nameisnull.+'"/>
         </parse>
     </case>
+    <case name="Oracle boolean-based multi-threaded enumeration - all entries">
+        <switches>
+            <url value="http://debiandev/sqlmap/oracle/get_int.php?id=1"/>
+            <threads value="4"/>
+            <tech value="B"/>
+            <extensiveFp value="True"/>
+            <getBanner value="True"/>
+            <getCurrentUser value="True"/>
+            <getCurrentDb value="True"/>
+            <getHostname value="True"/>
+            <isDba value="True"/>
+            <getUsers value="True"/>
+            <getPasswordHashes value="True"/>
+            <getPrivileges value="True"/>
+            <getRoles value="True"/>
+            <getDbs value="True"/>
+            <getTables value="True"/>
+            <getColumns value="True"/>
+            <getCount value="True"/>
+            <dumpTable value="True"/>
+            <db value="scott"/>
+            <tbl value="users"/>
+            <excludeSysDbs value="True"/>
+        </switches>
+        <parse>
+            <item value="Title: AND boolean-based blind - WHERE or HAVING clause"/>
+            <item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
+            <item value="banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
+            <item value="current user:    'SYS'"/>
+            <item value="current schema (equivalent to database on Oracle):    'SYS'"/>
+            <item value="hostname:    'debian"/>
+            <item value="current user is DBA:    True"/>
+            <item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
+            <item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+clear-text password: CHANGE_ON_INSTALL.+SYS \[.+password hash: 2D5A0C491B634F1B.+clear-text password: TESTPASS'"/>
+            <item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
+            <item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
+            <item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
+            <item value="r'Database: SCOTT.+ tables.+USERS'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
+            <item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
+        </parse>
+    </case>
+    <case name="Oracle error-based multi-threaded enumeration - all entries">
+        <switches>
+            <url value="http://debiandev/sqlmap/oracle/get_int.php?id=1"/>
+            <threads value="4"/>
+            <tech value="E"/>
+            <extensiveFp value="True"/>
+            <getBanner value="True"/>
+            <getCurrentUser value="True"/>
+            <getCurrentDb value="True"/>
+            <getHostname value="True"/>
+            <isDba value="True"/>
+            <getUsers value="True"/>
+            <getPasswordHashes value="True"/>
+            <getPrivileges value="True"/>
+            <getRoles value="True"/>
+            <getDbs value="True"/>
+            <getTables value="True"/>
+            <getColumns value="True"/>
+            <getCount value="True"/>
+            <dumpTable value="True"/>
+            <db value="scott"/>
+            <tbl value="users"/>
+            <excludeSysDbs value="True"/>
+            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
+        </switches>
+        <parse>
+            <item value="Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)"/>
+            <item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
+            <item value="banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
+            <item value="current user:    'SYS'"/>
+            <item value="current schema (equivalent to database on Oracle):    'SYS'"/>
+            <item value="hostname:    'debian"/>
+            <item value="current user is DBA:    True"/>
+            <item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
+            <item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
+            <item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
+            <item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
+            <item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
+            <item value="r'Database: SCOTT.+ tables.+USERS'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
+            <item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
+        </parse>
+    </case>
+    <case name="Oracle UNION query multi-threaded enumeration - all entries">
+        <switches>
+            <url value="http://debiandev/sqlmap/oracle/get_int.php?id=1"/>
+            <threads value="4"/>
+            <tech value="U"/>
+            <extensiveFp value="True"/>
+            <getBanner value="True"/>
+            <getCurrentUser value="True"/>
+            <getCurrentDb value="True"/>
+            <getHostname value="True"/>
+            <isDba value="True"/>
+            <getUsers value="True"/>
+            <getPasswordHashes value="True"/>
+            <getPrivileges value="True"/>
+            <getRoles value="True"/>
+            <getDbs value="True"/>
+            <getTables value="True"/>
+            <getColumns value="True"/>
+            <getCount value="True"/>
+            <dumpTable value="True"/>
+            <db value="scott"/>
+            <tbl value="users"/>
+            <excludeSysDbs value="True"/>
+            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
+        </switches>
+        <parse>
+            <item value="Title: Generic UNION query (NULL) - 3 columns"/>
+            <item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
+            <item value="banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
+            <item value="current user:    'SYS'"/>
+            <item value="current schema (equivalent to database on Oracle):    'SYS'"/>
+            <item value="hostname:    'debian"/>
+            <item value="current user is DBA:    True"/>
+            <item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
+            <item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
+            <item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
+            <item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
+            <item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
+            <item value="r'Database: SCOTT.+ tables.+USERS'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
+            <item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
+        </parse>
+    </case>
+    <case name="Oracle partial UNION query multi-threaded enumeration - all entries">
+        <switches>
+            <url value="http://debiandev/sqlmap/oracle/get_int_partialunion.php?id=1"/>
+            <threads value="4"/>
+            <tech value="U"/>
+            <extensiveFp value="True"/>
+            <getBanner value="True"/>
+            <getCurrentUser value="True"/>
+            <getCurrentDb value="True"/>
+            <getHostname value="True"/>
+            <isDba value="True"/>
+            <getUsers value="True"/>
+            <getPasswordHashes value="True"/>
+            <getPrivileges value="True"/>
+            <getRoles value="True"/>
+            <getDbs value="True"/>
+            <getTables value="True"/>
+            <getColumns value="True"/>
+            <getCount value="True"/>
+            <dumpTable value="True"/>
+            <db value="scott"/>
+            <tbl value="users"/>
+            <excludeSysDbs value="True"/>
+            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
+        </switches>
+        <parse>
+            <item value="Title: Generic UNION query (NULL) - 3 columns"/>
+            <item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
+            <item value="banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
+            <item value="current user:    'SYS'"/>
+            <item value="current schema (equivalent to database on Oracle):    'SYS'"/>
+            <item value="hostname:    'debian"/>
+            <item value="current user is DBA:    True"/>
+            <item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
+            <item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
+            <item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
+            <item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
+            <item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
+            <item value="r'Database: SCOTT.+ tables.+USERS'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
+            <item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
+        </parse>
+    </case>
+    <case name="Oracle time-based single-threaded enumeration - all entries">
+        <switches>
+            <url value="http://debiandev/sqlmap/oracle/get_int_nooutput.php?id=1"/>
+            <tech value="T"/>
+            <timeSec value="2"/>
+            <getBanner value="True"/>
+            <isDba value="True"/>
+        </switches>
+        <parse>
+            <item value="Title: Oracle AND time-based blind"/>
+            <item value="banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
+            <item value="current user is DBA:    True"/>
+        </parse>
+    </case>
+    <case name="Oracle inline queries multi-threaded enumeration - all entries">
+        <switches>
+            <url value="http://debiandev/sqlmap/oracle/get_int_inline.php?id=1"/>
+            <threads value="4"/>
+            <tech value="Q"/>
+            <extensiveFp value="True"/>
+            <getBanner value="True"/>
+            <getCurrentUser value="True"/>
+            <getCurrentDb value="True"/>
+            <getHostname value="True"/>
+            <isDba value="True"/>
+            <getUsers value="True"/>
+            <getPasswordHashes value="True"/>
+            <getPrivileges value="True"/>
+            <getRoles value="True"/>
+            <getDbs value="True"/>
+            <getTables value="True"/>
+            <getColumns value="True"/>
+            <getCount value="True"/>
+            <dumpTable value="True"/>
+            <db value="scott"/>
+            <tbl value="users"/>
+            <excludeSysDbs value="True"/>
+            <answers value="do you want to perform a dictionary-based attack against retrieved password hashes=N"/>
+        </switches>
+        <parse>
+            <item value="Title: Oracle inline queries"/>
+            <item value="r'back-end DBMS: active fingerprint: Oracle 10g'"/>
+            <item value="banner:    'Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Prod'"/>
+            <item value="current user:    'SYS'"/>
+            <item value="current schema (equivalent to database on Oracle):    'SYS'"/>
+            <item value="hostname:    'debian"/>
+            <item value="current user is DBA:    True"/>
+            <item value="r'database management system users \[.+ANONYMOUS.+SCOTT.+SYS.+XDB'"/>
+            <item value="r'database management system users password hashes:.+CTXSYS \[.+password hash: 71E687F036AD56E5.+SYS \[.+password hash: 2D5A0C491B634F1B'"/>
+            <item value="r'database management system users privileges:.+CTXSYS.+ALTER SESSION.+ SYS .+ADMINISTER ANY SQL TUNING SET'"/>
+            <item value="r'database management system users roles:.+MDSYS.+CONNECT.+SYS \(administrator\).+DBA.+JAVA_DEPLOY'"/>
+            <item value="r'available databases \[.+CTXSYS.+SCOTT.+WMSYS'"/>
+            <item value="r'Database: SCOTT.+ tables.+USERS'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+3 columns.+SURNAME.+VARCHAR2'"/>
+            <item value="r'Database: SCOTT.+Table.+Entries.+USERS.+5'"/>
+            <item value="r'Database: SCOTT.+Table: USERS.+5 entries.+luther.+nameisnull.+'"/>
+        </parse>
+    </case>
     <case name="SQLite boolean-based multi-threaded enumeration - all entries">
         <switches>
             <url value="http://debiandev/sqlmap/sqlite/get_int.php?id=1"/>