Archive for the ‘software’ Category

Pangolin with enhanced Oracle support

Montag, April 20th, 2009

Zwell has posted an entry on Full Disclosure (FD) about a new version of Pangolin. This new version comes with an enhanced Oracle support

Sometimes we meet Oracle database when we do web sql injection testing. All we do is to dump some data in the db. But you know what? Actually, we can do more and more operation of it, just like:
1. Fast data dumping even cannot use union select
2. Dump server information like : db name, sid, real internet ip address, user list, user hash and so on.
3. Execute PL/SQL
4. Privilege escalation
5. Crack user password
6. Execute system command
7. Install oracle rootkit
8. and so many others

Maybe you could say it cannot execute multi-sql through a single query. Don’t worry. There is a demo at, you can watch it and learn a lot of things about Oracle sql injection.

Most of the stuff is not new… (at least not for me)

1. Fast data dumping even cannot use union select
==>usage of utl_http to get additional data.  A faster way getting all results from multiple queries in a single query is described in a blog entry here.

utl_http is often revoked from public for security reasons. The usage of httpuritype is normally more reliable from the security perspective.

2. Dump server information:
==> via sys_context function. That’s standard Oracle functionality. Nothing special.

3. Execute PL/SQL
==> Pangolin is doing this via an exploit in dbms_export_extension. The bug in dbms_export_extension is old but this exploit was new for me…

4.  Privilege escalation
==> I guess they are doing this via the exploit in dbms_export_extension

5.  Crack (Oracle database) user password
==> Matrixay is doing this since several years.

6. Execute OS commands
==> several techniques (create table, dbms_scheduler, extproc, java, oracle text, plsql_native_9, plsql_native_10, set_events) are available to do this. Via PL/SQL this is easy to achieve…

7. Install Oracle rootkit
==> yeah. Simple via plsql

Maybe you could say it cannot execute multi-sql through a single query.
==> Stacked queries are not possible in Oracle. Correct me if I’m wrong. You are using a PL/SQL Injection vulnerability in a SQL function. This is a small but important difference.

BTW. :
The current version of Pangolin is using Openssl to crack Oracle passwords but not adding the Openssl license to pangolin. This is a license violation of the OpenSSL license…

Here is a screen shot of Pangolin 2.0 (taken from the flash movie from the pangolin website):

Pangolin 2.0

3 new Oracle Security Videos

Donnerstag, April 16th, 2009

I just uploaded 3 new Oracle security videos:

Trial version of Repscan available on the Sentrigo website.

Web Application Testing with Matrixay 2.5

Mittwoch, März 4th, 2009

Today I uploaded a new video „Web Application Testing with Matrixay 2.5“ (1024×768). In this video I am using Matrixay to extract the structure of a database (tables, columns, …) via a SQL Injection vulnerability in one of my vulnerable test applications (Oracle & PHP). After that I am downloading the content of the table.

Matrixay is a really good and easy to use commercial web scanner from DBAppSecurity Ltd.


Matrixay supports all kind of databases (Oracle, MSSQL, MySQL, DB2, …) and can even do simple database audit (e.g. check for weak Oracle passwords, …).

More videos can be found in our video section. I will add more in the next few weeks.

Inguma – Free Oracle Penetration Toolkit from Joxean Koret

Samstag, Oktober 20th, 2007

Joxean Koret released version 0.05 of his free penetration toolkit called Inguma. This tool is also implementing an exploit for one of the bugs (LT.FINDRICSET) fixed in the October 2007 CPU.

The name Inguma is coming from the basque god of dreams who kills people while sleeping and, also, the one who make the nightmares.

Inguma, written in Phython, supports different systems (e.g. Oracle, SQL Server, SSH, Firewalls). The following features are Oracle specific:

* Added one exploit for the vulnerability in SYS.LT.FINDRICSET (Oracle CPU Oct. 2007).
* Added module „bruteora“ to brute force Oracle servers. It will check
for every (commonly) possible user or for an specified user.
* Added a tool to crack MD5 hashes using freely available rainbow tables.
* Added module „sidguess“ to guess the SID of an Oracle Database instance.
* Added a password cracker for Oracle11g.
* Enhanced the Oracle PL/SQL Fuzzer. Now, if you redirect the output
only the vulnerabilities found are logged, all the rest of the output
are written to stderr.

Here a screenshot from the tool on my Backtrack 2 system:

Inguma Screenshot 1

Well done Joxean.

GOSS – GUI Oracle scanner

Sonntag, Oktober 14th, 2007

From time to time I’m doing research on Russian websites (with Google Translate) because you can find interesting information and tools. Last week I found a small program Oracle scanner called goss a GUI Oracle Scanner.

GUI Oracle Scanner

This tools contains features like getting the SID (similar to sidguess), password guessing, retrieve password hashes from the database, …

GUI Oracle Scanner II

The output is displayed in a new window.

GUI Oracle Scanner III

Some of the features in this tool where not working properly against my test databases.