Re: [PEN-TEST] hacking oracle questions

[Michael Owen <mowen () COSTCO COM>]

> 1) How do I discover what table names exist in a particular
> Oracle database
>    i.e. the schema? Once I have the table names, I can use the
>    "describe" command in svrmgrl to get the columns in the
>    table , but apparently there is no easy way to get the
>    table names themselves..

the following will return a list of users, as well as all the tables each
one owns:

select owner, table_name
from all_tables
order by owner, table_name;



> 2) It appears I may need to use the Schema Editor (java interface),
>    but it doesn't appear that the username/password there match
>    up with any user accounts in Oracle. What is the relationship
>    between the accounts for the java interface versus actual
>    Oracle accounts (accessible through sqlplus)?

The username/password is probably for accessing an oem (Oracle Enterprise
Manager) server, which is a service running on your nt box. Look for a
service named Oracle[orahome]ManagementServer. You can use dba studio to
hook into the management server, and perform all kinds of sweet ops on the
databases it manages. The oracle username is probably REPOSITORY/REPOSITORY
or someother similar name. The default username/password to get into OEM is
SYSMAN/OEM_TEMP.


HTH,
Mike




----------------------------------
Michael Owen
Costco Wholesale
Network Security
(425) 313-2957