January 2007
Intermediate to advanced
190 pages
3h 47m
English
Content preview from The Oracle® Hacker's Handbook: Hacking and Defending Oracle
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
5.9. The DBMS_ASSERT Package
10g Release 2 introduced a new package call DBMS_ASSERT, which has since been retrofitted to earlier versions. Due to the large amount of PL/SQL injection vulnerabilities discovered by security researchers between 2003 and 2005, Oracle invested in a data flow analysis tool to find SQL injection flaws. Any that are found are usually fixed with the DBMS_ASSERT package, which is used to validate user input. This was a great step forward for Oracle; and when they released 10g Release 2, the difference really showed. The number of SQL injection flaws found dropped off dramatically, as most of them had been fixed; but not all of them. It is clear that the tool they use has several shortcomings. While it is around 95 percent effective for catching direct user input SQL injection vulnerabilities, it does nothing when it comes to second-order SQL injection.
In second-order SQL injection, a column in a table is loaded with the SQL exploit and at a later stage this column is selected and then embedded in a dynamic SQL query (see the discussion later on EXTEND_WINDOW_LIST in "Exploiting DBMS_CDC_SUBSCRIBE and DBMS_CDC_ISUBSCRIBE." Another problem with their tool is that it seems (and I say "seems" because, without access to their tool, I can make only suppositions about its problems based on available evidence) to stop at exit points from the PL/SQL code, so when a PL/SQL function calls a C or Java function that is vulnerable to SQL injection, the tool seems not ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.