The Database Hacker's Handbook: Defending Database Servers

Index

SYMBOLS AND NUMERICS

@@version variable (Sybase), 217–218

|| (double pipe) with Windows Command Interpreter, 43

″ (double quotes) for SQL injection (Sybase), 220

# (hash mark) in #NISR... notation, 12

one-bit patch Trojan (MySQL), 302–303

′ (single quote)

CHAR function to bypass quote filters (Sybase), 219–220

SQL injection using (MySQL), 282

SQL injection using (SQL Server), 359–362

SQL injection using (Sybase), 214–215

three-byte patch backdoor (SQL Server), 370–373

0x0A leading byte DoS (SQL Server), 357

0x08 leading byte heap overflow (SQL Server), 356–357

A

accounts (DB2)

enabling lockout, 153–154

on Linux, 109

OS accounts and default passwords, 110

accounts (Informix)

authorization, 163–164

creating highly privileged accounts, 184

discovering server instance name, 160

accounts (MySQL)

columns_priv table, 270, 271

db table, 269–270

hosts table, 270

one-bit patch altering authentication, 302–303

password for root@localhost account, 322

principle of least privilege, 324

privilege model, 266–272

removing non-root users, 322

renaming root account, 322

restricting by IP address, 323–324

routine audit, 327

tables_priv table, 270–271

user table, 266–269, 272

accounts (Oracle)

changing default passwords, 90

database account authentication, 32

DBA privileged, 33–34, 57–59, 93–95

DBSNMP, 27, 32, 36, 49

default accounts and passwords, 48–49

default usernames and passwords, 447–469

enabling user account lockout, 92

for Intelligent Agent, 32

MDSYS, 49, 68–70

new account creation, ...