David has released an Oracle Assessment Toolkit on his website. This is a set of tools compiled into binaries that also include the C source code. The real gem is the fact that David has included a C source TNS library. The whole OAK zip is beta so dont expect everything to be perfect and complete, david has said he will complete it, let give him chance.
The kit includes a tool to get oracle versions (this can be seen in the OHH as well for explanations), a tool to enumerate users in a database without authenticating. A password brute force tool, a tool to retrieve the SID's from the listener, a tool to guess SID's and an example of the Jan 2006 CPU DB18 AUTH_ALTER_SESSION hack.
Worth downloading and also keeping an eye on for fixes and updates.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "3 new papers on Oracle forensics"] [Next entry: "A new Oracle Security Apprentice?"]
April 2007
- Bunker has released a 0-day Oracle exploit - 04/02/2007 by 04/02/2007
- Argeniss have released a simple Oracle root kit - 04/03/2007 by 04/03/2007
- 3 new papers on Oracle forensics - 04/04/2007 by 04/04/2007
- Oracle Assessment Toolkit - 04/09/2007 by 04/09/2007
- A new Oracle Security Apprentice? - 04/12/2007 by 04/12/2007
- Oracle Critical Patch Update April 2007 is out - 04/17/2007 by 04/17/2007
- Oracle Updates Leave Critical Windows Flaw - 04/18/2007 by 04/18/2007
- Analysis of April 2007 CPU - 04/19/2007 by 04/19/2007
- NGS have released an analysis for the April CPU 2007 - 04/20/2007 by 04/20/2007
- I am speaking at the Northern Server Technology day tomorrow 24th April - 04/23/2007 by 04/23/2007
- Oracle forensics in a nutshell - 04/28/2007 by 04/28/2007
Archives
Syndication
Powered by gm-rss 2.0.0
