The Oracle® Hacker's Handbook: Hacking and Defending Oracle

The Oracle® Hacker's Handbook: Hacking and Defending Oracle

by David Litchfield
Released January 2007
Publisher(s): Wiley
ISBN: 9780470080221

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Book description

David Litchfield has devoted years to relentlessly searching out the flaws in the Oracle database system and creating defenses against them. Now he offers you his complete arsenal to assess and defend your own Oracle systems. This in-depth guide explores every technique and tool used by black hat hackers to invade and compromise Oracle and then it shows you how to find the weak spots and defend them. Without that knowledge, you have little chance of keeping your databases truly secure.

Table of contents

  1. Copyright
  2. Dedication
  3. About the Author
  4. Credits
  5. Acknowledgments
  6. Introduction
    1. Code Samples from the Book
    2. Oracle and Security
    3. The "Unbreakable" Marketing Campaign
    4. Independent Security Assessments
    5. The Future
  7. Overview of the Oracle RDBMS
    1. Architecture
    2. Processes
    3. The File System
    4. The Network
    5. Oracle Patching
    6. Wrapping Up
  8. The Oracle Network Architecture
    1. The TNS Protocol
    2. Getting the Oracle Version
    3. Wrapping Up
  9. Attacking the TNS Listener and Dispatchers
    1. Attacking the TNS Listener
    2. The Aurora GIOP Server
    3. The XML Database
    4. Wrapping Up
  10. Attacking the Authentication Process
    1. How Authentication Works
    2. Attacks Against the Crypto Aspects
    3. Default Usernames and Passwords
    4. Account Enumeration and Brute Force
    5. Wrapping Up
  11. Oracle and PL/SQL
    1. What Is PL/SQL?
    2. PL/SQL Execution Privileges
    3. Wrapped PL/SQL
    4. PL/SQL Injection
    5. Investigating Flaws
    6. Direct SQL Execution Flaws
    7. PL/SQL Race Conditions
    8. Auditing PL/SQL Code
    9. The DBMS_ASSERT Package
    10. Some Real-World Examples
    11. Wrapping Up
  12. Triggers
    1. Trigger Happy: Exploiting Triggers for Fun and Profit
    2. Examples of Exploiting Triggers
    3. Wrapping Up
  13. Indirect Privilege Escalation
    1. A Hop, a Step, and a Jump: Getting DBA Privileges Indirectly
    2. Wrapping Up
  14. Defeating Virtual Private Databases
    1. Tricking Oracle into Dropping a Policy
    2. Defeating VPDs with Raw File Access
    3. General Privileges
    4. Wrapping Up
  15. Attacking Oracle PL/SQL Web Applications
    1. Oracle PL/SQL Gateway Architecture
    2. Recognizing the Oracle PL/SQL Gateway
    3. Verifying the Existence of the Oracle PL/SQL Gateway
    4. Attacking the PL/SQL Gateway
    5. Wrapping Up
  16. Running Operating System Commands
    1. Running OS Commands through PL/SQL
    2. Running OS Commands through Java
    3. Running OS Commands Using DBMS_SCHEDULER
    4. Running OS Commands Directly with the Job Scheduler
    5. Running OS Commands Using ALTER SYSTEM
    6. Wrapping Up
  17. Accessing the File System
    1. Accessing the File System Using the UTL_FILE Package
    2. Accessing the File System Using Java
    3. Accessing Binary Files
    4. Exploring Operating System Environment Variables
    5. Wrapping Up
  18. Accessing the Network
    1. Data Exfiltration
    2. Encrypting Data Prior to Exfiltrating
    3. Attacking Other Systems on the Network
    4. Java and the Network
    5. Database Links
    6. Wrapping Up
  19. Default Usernames and Passwords

Product information

  • Title: The Oracle® Hacker's Handbook: Hacking and Defending Oracle
  • Author(s): David Litchfield
  • Release date: January 2007
  • Publisher(s): Wiley
  • ISBN: 9780470080221