Related Chapters:

• Chapter 5: Attacking and Defending Windows 2000

• Chapter 14: Attacking and Defending Unix

Introduction

Oracle databases are massive, complex beasts with an amazing amount of undocumented and hidden functionality. It would take an army of researchers years to catalog everything, and the resulting document would rival the Encyclopedia Britannica, so this chapter concentrates on certain key areas and examines them in detail. A working, or at least basic, knowledge of Oracle security and database architecture is assumed.

The task of attacking servers that are running Oracle software can be broken down into many steps that closely match the architecture. There are those attacks against vulnerabilities in the Listener that do not require the attacker to be authenticated. These kinds of vulnerabilities are the elixir for the system cracker; real hackers don't use passwords. And there are those attacks that require that the user at least have a low privileged account with which they can log into the database. Finally, there are those attacks that require a high privileged account and are generally leveled at systems to gain further access. Accordingly, this chapter is split up into three main attack sections: on attacking the Listener, attacking the database, and attacking the Oracle application server.