The Ethical Hacker Network

Latest Additions

Who's Online

EH-Net News Feeds

Latest Additions

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > Hacking Oracle

Pages: [1] Go Down

« previous next »

	Author	Topic: Hacking Oracle (Read 4248 times)
0 Members and 1 Guest are viewing this topic.

H1t M0nk3y

Hero Member

Offline

Posts: 660

Hacking Oracle

« on: June 14, 2010, 07:00:20 AM »

In a lab, I have 2 servers with Oracle 10g installed on.

I want to check if they are both secure, but I don't know how I should proceed with the pentest. I know I need the SID along with a tool to make a connection to the database.

So far, all that I found on the internet was pretty old, using tools in backtrack 2 or talking about Oracle 9i or older.

Anyone knowing about tools or a useful link on that topic?


	Logged

GPEN, GSEC, CEH, CISSP, PMP

xXxKrisxXx

Sr. Member

Offline

Posts: 491

Re: Hacking Oracle

« Reply #1 on: June 14, 2010, 12:24:59 PM »

Chris Gate's has done some pentesting work on oracle & has written some walkthroughs. May want to check out some of his posts on his Blog http://carnal0wnage.blogspot.com/search?q=oracle (Scroll down)


	Logged

OSCP, OWSP, eCPPT

H1t M0nk3y

Hero Member

Offline

Posts: 660

Re: Hacking Oracle

« Reply #2 on: June 15, 2010, 07:01:03 AM »

Thanks xXxKrisxXx,

I will give it a try tonight in my lab.


	Logged

GPEN, GSEC, CEH, CISSP, PMP

aweSEC

Hero Member

Offline

Posts: 1100

Re: Hacking Oracle

« Reply #3 on: June 18, 2010, 07:04:59 AM »

I haven't read those books, but they should fit your needs:

HOWTO Secure and Audit Oracle 10g and 11g
The Oracle Hacker's Handbook: Hacking and Defending Oracle


	Logged

H1t M0nk3y

Hero Member

Offline

Posts: 660

Re: Hacking Oracle

« Reply #4 on: June 18, 2010, 10:50:53 AM »

Thanks awesec, I am waiting for my new assignment and if it involves Oracle, I will probably buy one of them...


	Logged

GPEN, GSEC, CEH, CISSP, PMP

jimbob

Guest

Re: Hacking Oracle

« Reply #5 on: June 18, 2010, 11:11:13 AM »

For tools to connect to Oracle check out SQLPlus, the command line tool that ships with oracle. A free GUI called SQL Developer is available from Oracle if you want something more visual.

There are a few good oracle security tools out there and some modules in metasploit for Oracle scanning and enumeration. POET is a recently release tool for Oracle pen testing.

http://pentestit.com/2010/06/08/poet-padding-oracle-exploit-tool/

Cheers,
Jim


	Logged

LSOChris

Guest

Re: Hacking Oracle

« Reply #6 on: June 19, 2010, 08:30:37 AM »

you can check out my whitepaper from Blackhat to get you started

http://www.blackhat.com/presentations/bh-usa-09/GATES/BHUSA09-Gates-OracleMetasploit-PAPER.pdf

you may also need to check out the metasploit wiki to get the gem installed to use the oracle mixin

http://www.metasploit.com/redmine/projects/framework/wiki/OracleUsage


	Logged

Pages: [1] Go Up

« previous next »

Jump to:

SANS Deals 4 EH-Netters

$150 OFF Any SANS Course in Any Format!
Coupon Code: EHN_Connect Including SANS Security West 2012 & SANSFIRE 2012

Recent Forum Topics