.

[Article]-Oracle Web Hacking Part I

<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu Apr 21, 2011 2:12 pm

[Article]-Oracle Web Hacking Part I

After 2 years advancing his career (and his family), Chris Gates is back with a new article. He'll be bringing you some Oracle hotness.

Thanks Chris, and it's great to have you back.

Permanent link: [Article]-Oracle Web Hacking Part I


Image


By Chris Gates, CISSP, GCIH, C|EH, CPTS

Oracle applications are not what you’d call simple.  I think any DBA or Oracle Application Server Administrator will be the first to attest to that fact.  Oracle, with its great products, comes with some un-pleasantries.  These are:

1. Oracle applications are complicated (hopefully we all agree on this).[br /]
2. They come with loads of default content and no clear way to remove that content.  There is no IISLockdown equivalent for Oracle applications.  Content you don’t want must be removed manually.  Some of this content can be used to run database queries, read documents, gather information via information leakage on the pages or perform XSS attacks.[br /]
3. Users have to pay for patches and extended advisory information (even then, no Proof of Concept code is released by Oracle).[br /]
4. And lastly, you have a fairly complicated patch/upgrade process which leads to an "it’s working, don’t touch it" mentality by a fair amount of admins.

This provides a target rich environment for pentesters and bad guys. Let’s take a look.



Let us know what you think,
Don
CISSP, MCSE, CSTA, Security+ SME
<<

chrisg

Post Fri Apr 22, 2011 9:27 pm

Re: [Article]-Oracle Web Hacking Part I

thanks Don!

questions or comments send them my way.
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Sat Apr 23, 2011 7:46 am

Re: [Article]-Oracle Web Hacking Part I

Very nice! Thanks, CG!

Are there version limitations on these applications provided by Oracle? I see in one of the screenshots you're looking at 10g (9.0.4) but are there versions where you're likely to see some of this out there as opposed to versions that won't have it?
<<

chrisg

Post Tue Apr 26, 2011 3:05 pm

Re: [Article]-Oracle Web Hacking Part I

so every web app is different from a default content point of view, privilege escalation, XSS, sqli would be dependent on both the backend DB and the oracle application itself.

hope that makes sense. 

Return to Gates

Who is online

Users browsing this forum: No registered users and 0 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software