Re: oracle VA/PT

From: Lukasz Szczepanski (securityfocus_at_o2.pl)
Date: 09/28/05

  • Next message: Thomas Springer: "How to check for SSL1 ?" 
    Date: Wed, 28 Sep 2005 09:37:14 +0200
To: pen-test@securityfocus.com

    Hello,

    Personally i recomend 'checkpwd 1.1' - free dictionary-based tool for
    Oracle DB's, which can be found under this link:

    http://www.red-database-security.com/software/checkpwd.html

    You can found there both windows compilation and linux sources and more
    information :-). default/weak password list is also included.
    Have fun :-)

    ---------------------------------------------------------------------------
    SAMPLE OUTPUT:
    ---------------------------------------------------------------------------

    Checkpwd 1.10 - (c) 2005 by Red-Database-Security GmbH

    Oracle Security Consulting, Security Audits & Security Trainings
    http://www.red-database-security.com

    initializing Oracle client library
    connecting to the database
    retrieving users and password hash values
    opening weak password list file
    reading weak passwords list
    checking passwords
    MDSYS has weak password MDSYS [EXPIRED & LOCKED]
    ORDSYS has weak password ORDSYS [EXPIRED & LOCKED]
    DUMMY123 has weak password DUMMY123 [OPEN]
    DBSNMP OK [OPEN]
    SCOTT has weak password TIGER [OPEN]
    CTXSYS has weak password CHANGE_ON_INSTALL [EXPIRED & LOCKED]
    SH has weak password CHANGE_ON_INSTALL [EXPIRED & LOCKED]
    OUTLN has weak password OUTLN [EXPIRED & LOCKED]
    DIP has weak password DIP [EXPIRED & LOCKED]
    DUMMY321 has weak password 123YMMUD [OPEN]
    [...]
    SYS OK [OPEN]
    SYSTEM OK [OPEN]

    Done. Summary:
    Passwords checked : 13900828
    Weak passwords found : 23
    Elapsed time (min:sec) : 1:24
    Passwords / second : 165486

    ---------------------------------------------------------------------------

    PS. Standalone version doesnt need oracle client to run.

    > Hi to all.
    >
    > Some day ago I was quite surprised to see that on a server that was
    > scanned with nessus and with emaze scanner that revealed no relevant
    > security hole, there was oracle installed and active with all the
    > default oracle user/password activated (i.e. system/manager,
    > scott/tiger, etc).
    >
    > What VA tool can find default user on oracle? Is it possible to find
    > that info with Nessus (perhaps I can't use it at its best)?
    >
    > Best Regards,
    > Massimo
    > PS
    > I usually activate all the check on nessus and emaze.
    >
    > ------------------------------------------------------------------------------
    >
    > Audit your website security with Acunetix Web Vulnerability Scanner:
    > Hackers are concentrating their efforts on attacking applications on
    > your website. Up to 75% of cyber attacks are launched on shopping
    > carts, forms, login pages, dynamic content etc. Firewalls, SSL and
    > locked-down servers are futile against web application hacking. Check
    > your website for vulnerabilities to SQL injection, Cross site
    > scripting and other web attacks before hackers do! Download Trial at:
    >
    > http://www.securityfocus.com/sponsor/pen-test_050831
    > -------------------------------------------------------------------------------
    >
    >
    >
    >

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Thomas Springer: "How to check for SSL1 ?"

    Relevant Pages

    • [Full-disclosure] New Tool: Oracle Password Checker
      ... We have implemented a free dictionary based Oracle password checker for ... Oracle databases called checkpwd. ... INTERNET_APPSERVER_REGISTRY has weak password ...
      (Full-Disclosure)
    • Oracle Password Checker
      ... we have implemented a free dictionary based Oracle password checker ... for Oracle databases called checkpwd 1.0. ... INTERNET_APPSERVER_REGISTRY has weak password INTERNET_APPSERVER_REGISTRY ...
      (Bugtraq)
    • New tool: Oracle Password Checker
      ... We have implemented a free dictionary based Oracle password checker for Oracle databases called checkpwd. ... INTERNET_APPSERVER_REGISTRY has weak password INTERNET_APPSERVER_REGISTRY ...
      (Pen-Test)
    • Re: securing SSH, FBSD systems
      ... These attacks are almost exclusively automated, ... username and weak password combinations - blank password, ... Move sshd to listen on a different port. ... Keep up-to-date with security patches and advisories. ...
      (freebsd-questions)