Musings on Database Security

Oracle TNS Resend Packet

Slavik — Sun, 07 Mar 2010 22:41:56 +0000

As you can see here, the Python code handles a specific case of Oracle TNS layer requesting a RESEND of the last packet. I’ve noticed that no matter what client I’m trying to connect with, Oracle is always requesting a RESEND after the initial CONNECT request as you can see here (removed various ACK packets, [...]

SC Magazine awards dinner

Slavik — Sat, 06 Mar 2010 01:41:36 +0000

We had a great time at the SC magazine awards dinner on Tuesday. We were finalists in the “best SME security solution” category but unfortunately we did not win. Here is Andy, our VP marketing before the dinner and announcements: And here he is after some wine and us not winning:

RSA Conference 2010 – Linux WIFI users

Slavik — Tue, 02 Mar 2010 19:42:00 +0000

So, I arrived to Moscone Center a bit late for the first cloud security alliance session. It turns out that there was a huge line to enter and a lot of people were left outside. Having a free 1.5 hours, I wanted to connect and check emails. I’ve already received my password so I thought it [...]

Enumerate Oracle SIDs

Slavik — Fri, 26 Feb 2010 20:37:00 +0000

As promised, here is a small Python script to allow you to enumerate and find Oracle SIDs. Of course, the usual caveats apply – if it breaks something, I’m not responsible Use at your own risk. I’m using the sidlist.txt file from David’s OAK but there are plenty of available resources with common SID [...]

Exploiting Oracle from the web whitepaper

Slavik — Tue, 23 Feb 2010 02:47:00 +0000

Sumit Siddarth (Sid) has published an excellent whitepaper talking about hacking Oracle from the web. It shows many types and techniques of SQL injection and how to use an SQL injection vulnerability as a jumping point to extract data, take control of the database and even escape the database to the OS. Security folks and DBAs [...]

RMOUG presentation

Slavik — Fri, 19 Feb 2010 18:30:32 +0000

I had a great time at RMOUG this year. Did one of my usual presentation about attack vectors on the database and how to defend against them. I think the presentation was well received and the attendees loved the demos – I mostly just demonstrate instead of going through slides. One of my favorite demos is [...]