December 2016
Beginner
494 pages
12h 34m
English
Content preview from Network Security Assessment, 3rd Edition
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Chapter 15. Assessing Data Stores
Databases, key-value stores, and other systems are used to cache and serve data. Attackers often compromise data stores by abusing weaknesses within their configuration, authenticating with valid credentials, and escalating privileges.
The data stores described in this chapter include relational and nonrelational databases, file service protocols, distributed file systems, and key-value stores. Table 15-1 lists implementations, service ports, and tool support within Kali Linux.
| Name | Port | Protocol | Nmap | MSFa | Hydra | ||
|---|---|---|---|---|---|---|---|
| TCP | UDP | ||||||
| MySQL | 3306 |
● |
– |
● |
● |
● |
|
| PostgreSQL | 5432 |
● |
– |
● |
● |
● |
|
| Microsoft SQL Server |
1433 1434 |
● – |
– ● |
● ● |
● ● |
● – |
|
| Oracle Database | 1521 |
● |
– |
● |
● |
● |
|
| MongoDB | 27017 |
● |
– |
● |
● |
– |
|
| Redis | 6379 |
● |
– |
● |
● |
● |
|
| Memcached | 11211 |
● |
● |
● |
● |
– |
|
| Hadoop | MapReduce | 50030 50060 |
● ● |
– – |
● ● |
– – |
– – |
| HDFS |
50070 50075 50090 |
● ● ● |
– – – |
● ● ● |
– – – |
– – – |
|
| NFS | 2049 |
● |
● |
● |
● |
– |
|
| AFP | 548 |
● |
– |
● |
● |
● |
|
| iSCSI | 3260 |
● |
– |
● |
– |
– |
|
a Metasploit Framework | |||||||
MySQL
MySQL is commonly found listening on TCP port 3306 of both Unix- and Windows-based servers. Nmap fingerprints the service, as demonstrated by Example 15-1. NVD lists a number of severe, unauthenticated, remotely exploitable vulnerabilities in MySQL at the time of writing, as listed in Table 15-2.
Example 15-1. MySQL service fingerprinting via ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.