Penetration Testing mailing list archives
Re: oracle VA/PT
From: Lukasz Szczepanski <securityfocus () o2 pl>
Date: Wed, 28 Sep 2005 09:37:14 +0200
Hello,Personally i recomend 'checkpwd 1.1' - free dictionary-based tool for Oracle DB's, which can be found under this link:
http://www.red-database-security.com/software/checkpwd.htmlYou can found there both windows compilation and linux sources and more information :-). default/weak password list is also included.
Have fun :-) --------------------------------------------------------------------------- SAMPLE OUTPUT: --------------------------------------------------------------------------- Checkpwd 1.10 - (c) 2005 by Red-Database-Security GmbH Oracle Security Consulting, Security Audits & Security Trainings http://www.red-database-security.com initializing Oracle client library connecting to the database retrieving users and password hash values opening weak password list file reading weak passwords list checking passwords MDSYS has weak password MDSYS [EXPIRED & LOCKED] ORDSYS has weak password ORDSYS [EXPIRED & LOCKED] DUMMY123 has weak password DUMMY123 [OPEN] DBSNMP OK [OPEN] SCOTT has weak password TIGER [OPEN] CTXSYS has weak password CHANGE_ON_INSTALL [EXPIRED & LOCKED] SH has weak password CHANGE_ON_INSTALL [EXPIRED & LOCKED] OUTLN has weak password OUTLN [EXPIRED & LOCKED] DIP has weak password DIP [EXPIRED & LOCKED] DUMMY321 has weak password 123YMMUD [OPEN] [...] SYS OK [OPEN] SYSTEM OK [OPEN] Done. Summary: Passwords checked : 13900828 Weak passwords found : 23 Elapsed time (min:sec) : 1:24 Passwords / second : 165486 --------------------------------------------------------------------------- PS. Standalone version doesnt need oracle client to run.
Hi to all.Some day ago I was quite surprised to see that on a server that was scanned with nessus and with emaze scanner that revealed no relevant security hole, there was oracle installed and active with all the default oracle user/password activated (i.e. system/manager, scott/tiger, etc).What VA tool can find default user on oracle? Is it possible to find that info with Nessus (perhaps I can't use it at its best)?Best Regards, Massimo PS I usually activate all the check on nessus and emaze.------------------------------------------------------------------------------Audit your website security with Acunetix Web Vulnerability Scanner:Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:http://www.securityfocus.com/sponsor/pen-test_050831-------------------------------------------------------------------------------
------------------------------------------------------------------------------Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at:
http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- oracle VA/PT Massimo (Sep 27)
- Re: oracle VA/PT Lukasz Szczepanski (Sep 28)
- Re: oracle VA/PT jd (Sep 29)
- <Possible follow-ups>
- RE: oracle VA/PT Josh Perrymon (Sep 28)
- RE: oracle VA/PT Gus Fritschie (Sep 29)
- RE: oracle VA/PT Josh Perrymon (Sep 28)
- RE: oracle VA/PT Michael Gargiullo (Sep 28)
- Re: oracle VA/PT Joshua Wright (Sep 29)