TA的每日心情 | 开心
2021-12-13 21:45 |
|---|
签到天数: 15 天 [LV.4]偶尔看看III
|
|
AUTHOR ： KJ0231320
TEAM ： I.S.T.O
以下是对ORACLE HINT FUZZ的时候发现的！
select
/*+ NO_PUSH_PRED(* dual --)*/
*
from
dual
以还有好些HINT都会出现如此语法错误或者会使当前Connection会话中断
研究了好久都没发现什么细节原因，跟踪不下去了。搁着快有半年了扔出来，后来者可以走少些弯路
顺便给出FUZZ的代码
package cn.isto.fuzz.oracle;
import java.sql.*;
import java.util.List;
public class SQLHintFuzzer {
private Object[] fuzzData=new Object[38];
private String[] hints = new String[182];
private Connection conn;
Statement stmt = null;
private String url;
private String user;
private String pass;
private String sql1;
private String loopCreateString(String initStr,int count){
StringBuilder tempsb = new StringBuilder();
for(int i=0;i<count;i++){
tempsb.append(initStr);
}
return tempsb.toString();
}
public SQLHintFuzzer(){
fuzzData[0]=-1;
fuzzData[1]=-2;
fuzzData[2]=0;
fuzzData[3]=1;
fuzzData[4]=2;
fuzzData[5]=2147483647;
fuzzData[6]=-2147483647;
fuzzData[7]=2147483648l;
fuzzData[8]=-2147483648;
fuzzData[9]=Long.MAX_VALUE;
fuzzData[10]=Long.MIN_VALUE;
fuzzData[11]=loopCreateString(""")",1);
fuzzData[12]=loopCreateString("/"",1);
fuzzData[13]=loopCreateString("--",1);
fuzzData[14]=loopCreateString("/*",1);
fuzzData[15]=loopCreateString("%s%s%s%s%s%s%s",1);
fuzzData[16]=loopCreateString("%x%x%x%x%x%x",1);
fuzzData[17]=loopCreateString("%d%d%d%d%d%d",1);
fuzzData[18]=loopCreateString("A",30);
fuzzData[19]=loopCreateString("A",100);
fuzzData[20]=loopCreateString("A",128);
fuzzData[21]=loopCreateString("A",256);
fuzzData[22]=loopCreateString("A",512);
fuzzData[23]=loopCreateString("A",1024);
fuzzData[24]=loopCreateString("A",2048);
fuzzData[25]=loopCreateString("A",3000);
fuzzData[26]=loopCreateString("A",4000);
fuzzData[27]=loopCreateString("A",5000);
fuzzData[28]=loopCreateString("A",6000);
fuzzData[29]=loopCreateString("A",8000);
fuzzData[30]=loopCreateString("A",10000);
fuzzData[31]=loopCreateString("A",15000);
fuzzData[32]=loopCreateString("A",20000);
fuzzData[33]=loopCreateString("A",25000);
fuzzData[34]=loopCreateString("A",30000);
fuzzData[35]=loopCreateString("A",32767);
fuzzData[36]=loopCreateString("SYS",1);
fuzzData[37]=loopCreateString("ROWID",1);
hints[0]="ALL_ROWS";
hints[1]="AND_EQUAL";
hints[2]="ANTIJOIN";
hints[3]="APPEND";
hints[4]="BITMAP";
hints[5]="BUFFER";
hints[6]="BYPASS_RECURSIVE_CHECK";
hints[7]="BYPASS_UJVC";
hints[8]="CACHE";
hints[9]="CACHE_CB";
hints[10]="CACHE_TEMP_TABLE";
hints[11]="CARDINALITY";
hints[12]="CHOOSE";
hints[13]="CIV_GB";
hints[14]="COLLECTIONS_GET_REFS";
hints[15]="CPU_COSTING";
hints[16]="CUBE_GB";
hints[17]="CURSOR_SHARING_EXACT";
hints[18]="DEREF_NO_REWRITE";
hints[19]="DML_UPDATE";
hints[20]="DOMAIN_INDEX_NO_SORT";
hints[21]="DOMAIN_INDEX_SORT";
hints[22]="DRIVING_SITE";
hints[23]="DYNAMIC_SAMPLING";
hints[24]="DYNAMIC_SAMPLING_EST_CDN";
hints[25]="EXPAND_GSET_TO_UNION";
hints[26]="FACT";
hints[27]="FIRST_ROWS";
hints[28]="FORCE_SAMPLE_BLOCK";
hints[29]="FULL";
hints[30]="GBY_CONC_ROLLUP";
hints[31]="GLOBAL_TABLE_HINTS";
hints[32]="HASH";
hints[33]="HASH_AJ";
hints[34]="HASH_SJ";
hints[35]="HWM_BROKERED";
hints[36]="IGNORE_ON_CLAUSE";
hints[37]="IGNORE_WHERE_CLAUSE";
hints[38]="INDEX_ASC";
hints[39]="INDEX_COMBINE";
hints[40]="INDEX_DESC";
hints[41]="INDEX_FFS";
hints[42]="INDEX_JOIN";
hints[43]="INDEX_RRS";
hints[44]="INDEX_SS";
hints[45]="INDEX_SS_ASC";
hints[46]="INDEX_SS_DESC";
hints[47]="INLINE";
hints[48]="LEADING";
hints[49]="LIKE_EXPAND";
hints[50]="LOCAL_INDEXES";
hints[51]="MATERIALIZE";
hints[52]="MERGE";
hints[53]="MERGE_AJ";
hints[54]="MERGE_SJ";
hints[55]="MV_MERGE";
hints[56]="NESTED_TABLE_GET_REFS";
hints[57]="NESTED_TABLE_SET_REFS";
hints[58]="NESTED_TABLE_SET_SETID";
hints[59]="NL_AJ";
hints[60]="NL_SJ";
hints[61]="NO_ACCESS";
hints[62]="NO_BUFFER";
hints[63]="NO_EXPAND";
hints[64]="NO_EXPAND_GSET_TO_UNION";
hints[65]="NO_FACT";
hints[66]="NO_FILTERING";
hints[67]="NO_INDEX";
hints[68]="NO_MERGE";
hints[69]="NO_MONITORING";
hints[70]="NO_ORDER_ROLLUPS";
hints[71]="NO_PRUNE_GSETS";
hints[72]="NO_PUSH_PRED";
hints[73]="NO_PUSH_SUBQ";
hints[74]="NO_QKN_BUFF";
hints[75]="NO_SEMIJOIN";
hints[76]="NO_STATS_GSETS";
hints[77]="NO_UNNEST";
hints[78]="NOAPPEND";
hints[79]="NOCACHE";
hints[80]="NOCPU_COSTING";
hints[81]="NOPARALLEL";
hints[82]="NOPARALLEL_INDEX";
hints[83]="NOREWRITE";
hints[84]="OR_EXPAND";
hints[85]="ORDERED";
hints[86]="ORDERED_PREDICATES";
hints[87]="OVERFLOW_NOMOVE";
hints[88]="PARALLEL";
hints[89]="PARALLEL_INDEX";
hints[90]="PIV_GB";
hints[91]="PIV_SSF";
hints[92]="PQ_DISTRIBUTE";
hints[93]="PQ_MAP";
hints[94]="PQ_NOMAP";
hints[95]="PUSH_PRED";
hints[96]="PUSH_SUBQ";
hints[97]="REMOTE_MAPPED";
hints[98]="RESTORE_AS_INTERVALS";
hints[99]="REWRITE";
hints[100]="RULE";
hints[101]="SAVE_AS_INTERVALS";
hints[102]="SCN_ASCENDING";
hints[103]="SELECTIVITY";
hints[104]="SEMIJOIN";
hints[105]="SEMIJOIN_DRIVER";
hints[106]="SKIP_EXT_OPTIMIZER";
hints[107]="SQLLDR";
hints[108]="STAR";
hints[109]="STAR_TRANSFORMATION";
hints[110]="SWAP_JOIN_INPUTS";
hints[111]="SYS_DL_CURSOR";
hints[112]="SYS_PARALLEL_TXN";
hints[113]="SYS_RID_ORDER";
hints[114]="TIV_GB";
hints[115]="TIV_SSF";
hints[116]="UNNEST";
hints[117]="USE_ANTI";
hints[118]="USE_CONCAT";
hints[119]="USE_HASH";
hints[120]="USE_MERGE";
hints[121]="USE_NL";
hints[122]="USE_SEMI";
hints[123]="USE_TTT_FOR_GSETS";
hints[124]="BYPASS_RECURSIVE_CHECK";
hints[125]="BYPASS_UJVC";
hints[126]="CACHE_CB";
hints[127]="CACHE_TEMP_TABLE";
hints[128]="CIV_GB";
hints[129]="COLLECTIONS_GET_REFS";
hints[130]="CUBE_GB";
hints[131]="CURSOR_SHARING_EXACT";
hints[132]="DEREF_NO_REWRITE";
hints[133]="DML_UPDATE";
hints[134]="DOMAIN_INDEX_NO_SORT";
hints[135]="DOMAIN_INDEX_SORT";
hints[136]="DYNAMIC_SAMPLING";
hints[137]="DYNAMIC_SAMPLING_EST_CDN";
hints[138]="EXPAND_GSET_TO_UNION";
hints[139]="FORCE_SAMPLE_BLOCK";
hints[140]="GBY_CONC_ROLLUP";
hints[141]="GLOBAL_TABLE_HINTS";
hints[142]="HWM_BROKERED";
hints[143]="IGNORE_ON_CLAUSE";
hints[144]="IGNORE_WHERE_CLAUSE";
hints[145]="INDEX_RRS";
hints[146]="INDEX_SS";
hints[147]="INDEX_SS_ASC";
hints[148]="INDEX_SS_DESC";
hints[149]="LIKE_EXPAND";
hints[150]="LOCAL_INDEXES";
hints[151]="MV_MERGE";
hints[152]="NESTED_TABLE_GET_REFS";
hints[153]="NESTED_TABLE_SET_REFS";
hints[154]="NESTED_TABLE_SET_SETID";
hints[155]="NO_EXPAND_GSET_TO_UNION";
hints[156]="NO_FACT";
hints[157]="NO_FILTERING";
hints[158]="NO_ORDER_ROLLUPS";
hints[159]="NO_PRUNE_GSETS";
hints[160]="NO_STATS_GSETS";
hints[161]="NO_UNNEST";
hints[162]="NOCPU_COSTING";
hints[163]="OVERFLOW_NOMOVE";
hints[164]="PIV_GB";
hints[165]="PIV_SSF";
hints[166]="PQ_MAP";
hints[167]="PQ_NOMAP";
hints[168]="REMOTE_MAPPED";
hints[169]="RESTORE_AS_INTERVALS";
hints[170]="SAVE_AS_INTERVALS";
hints[171]="SCN_ASCENDING";
hints[172]="SKIP_EXT_OPTIMIZER";
hints[173]="SQLLDR";
hints[174]="SYS_DL_CURSOR";
hints[175]="SYS_PARALLEL_TXN";
hints[176]="SYS_RID_ORDER";
hints[177]="TIV_GB";
hints[178]="TIV_SSF";
hints[179]="UNNEST";
hints[180]="USE_TTT_FOR_GSETS";
//sql1 = "select /*+" + orahint + "("+ +") */ * from dual";
//fuzzData[38]=null;
/*
numberFuzzData[0]=-1;
numberFuzzData[1]=-2;
numberFuzzData[2]=0;
numberFuzzData[3]=1;
numberFuzzData[4]=2;
numberFuzzData[5]=2147483647;
numberFuzzData[6]=-2147483647;
numberFuzzData[7]=2147483648l;
numberFuzzData[8]=-2147483648;
numberFuzzData[9]=Long.MAX_VALUE;
numberFuzzData[10]=Long.MIN_VALUE;
fuzzData[0]=loopCreateString("""",1);
strFuzzData[1]=loopCreateString("/"",1);
strFuzzData[2]=loopCreateString("%s%s%s%s%s%s%s",1);
strFuzzData[3]=loopCreateString("%x%x%x%x%x%x",1);
strFuzzData[4]=loopCreateString("%d%d%d%d%d%d",1);
strFuzzData[5]=loopCreateString("A",30);
strFuzzData[6]=loopCreateString("A",100);
strFuzzData[7]=loopCreateString("A",128);
strFuzzData[8]=loopCreateString("A",256);
strFuzzData[9]=loopCreateString("A",512);
strFuzzData[10]=loopCreateString("A",1024);
strFuzzData[11]=loopCreateString("A",2048);
strFuzzData[12]=loopCreateString("A",3000);
strFuzzData[13]=loopCreateString("A",4000);
strFuzzData[14]=loopCreateString("A",5000);
strFuzzData[15]=loopCreateString("A",6000);
strFuzzData[16]=loopCreateString("A",8000);
strFuzzData[17]=loopCreateString("A",10000);
strFuzzData[18]=loopCreateString("A",15000);
strFuzzData[19]=loopCreateString("A",20000);
strFuzzData[20]=loopCreateString("A",25000);
strFuzzData[21]=loopCreateString("A",30000);
strFuzzData[22]=loopCreateString("A",32767);
strFuzzData[23]=null;
strFuzzData[24]=loopCreateString("SYS",1);
strFuzzData[25]=loopCreateString("ROWID",1);
*/
}
public void login(String host,int port,String user,String pass,String sid) throws SQLException, ClassNotFoundException{
Class.forName("oracle.jdbc.driver.OracleDriver");
String url="jdbc:oracle:thin:@"+host+":"+port+":"+sid;
this.url=url;
this.user = user;
this.pass = pass;
connection();
}
private void connection() throws SQLException{
conn = DriverManager.getConnection(url,user,pass);
}
public void logout(){
closeAll(conn,null,null);
}
private void closeAll(Connection con,Statement stmt,ResultSet rs){
if(rs!=null){try{rs.close();}catch (Exception e) {}}
if(stmt!=null){try{stmt.close();}catch (Exception e) {}}
if(con!=null){try{con.close();}catch (Exception e) {}}
}
public void fuzz(){
try {
stmt = conn.createStatement();
} catch (SQLException e) {
e.printStackTrace();
}
for(int hintsc = 40 ; hintsc<hints.length; hintsc++){
System.out.println("FUZZ : "+hints[hintsc]);
for(int fuzzDc = 0; fuzzDc< fuzzData.length;fuzzDc++){
startFuzz(stmt,hints[hintsc]+"( "+ fuzzData[fuzzDc] +" )");
}
}
}
private void startFuzz(Statement fuzzstmt,String run){
try {
sql1 = "select /*+ "+run+"*/ * from dual";
fuzzstmt.execute(sql1);
Thread.sleep(1000);
} catch (Exception e) {
System.out.println(e.getMessage());
if(e.getMessage().indexOf("socket")>-1){
try {
connection();
stmt = conn.createStatement();
} catch (SQLException e1) {
System.out.println("error crash");
}
}
catch0day(e.getMessage(),sql1);
}
}
private void catch0day(String e,String run){
System.out.println(e+"---"+run);
}
public static void main(String[] args) throws SQLException, ClassNotFoundException{
SQLHintFuzzer shf = new SQLHintFuzzer();
shf.login("kj021320PC", 1521, "kj021320", "kj021320", "ORCL");
shf.fuzz();
shf.logout();
}
}
|
|
|手机版|Java学习者论坛
( 声明：本站资料整理自互联网，用于Java学习者交流学习使用，对资料版权不负任何法律责任，若有侵权请及时联系客服屏蔽删除 )
发表于 2018-7-7 16:33:19