The Oracle® Hacker's Handbook: Hacking and Defending Oracle

9.2. Recognizing the Oracle PL/SQL Gateway

When performing any kind of security assessment, it's important to know what technology you're actually dealing with. To that end, this section briefly examines how to recognize Oracle Portal when you come across it.

9.2.1. PL/SQL Gateway URLs

URLs for PL/SQL web applications are normally easily recognizable and generally start with the following (xyz can be any string and represents a Database Access Descriptor, which you will learn more about later):

http://server.example.com/pls/xyz

http://server.example.com/xyz/owa

http://server.example.com/xyz/plsql

While the second and third of these examples represent URLs from older versions of the PL/SQL Gateway, the first is from more recent versions running on Apache. In the plsql.conf Apache configuration file, /pls is the default, specified as a Location with the PLS module as the handler. The Location need not be /pls, however. The absence of a file extension in a URL could indicate the presence of the Oracle PL/SQL Gateway. Consider the following URL:

http://server/aaa/bbb/xxxxx.yyyyy

If xxxxx.yyyyy were replaced with something along the lines of "ebank.home," "store.welcome," "auth.login," or "books.search," then there's a fairly strong chance that the PL/SQL Gateway is being used. You can perform a few simple tests to verify this, but before looking at these let's fully explore the URL syntax:

http://server/pls/xyz/pkg.proc

In this URL, xyz is the Database Access Descriptor, or DAD. ...