RE: oracle VA/PT

From: Josh Perrymon (perrymonj_at_networkarmor.com)
Date: 09/28/05

  • Next message: Bernhard Mueller: "Re: MS SQL, find list of tables" 
    Date: Wed, 28 Sep 2005 05:59:00 -0500
To: "Massimo" <massimo.mail@quipo.it>, <pen-test@securityfocus.com>

    I have never known for Nessus not to find that Issue with Oracle. I have
    done several Assessments in the last week and it found defaults in
    Oracle, MySQL, and MSQL. Also found missing patches and no Listener
    passwords.

    You may want to run Absinthe on it and see what comes up.

    JP
    Network Armor

    -----Original Message-----
    From: Massimo [mailto:massimo.mail@quipo.it]
    Sent: Tuesday, September 27, 2005 12:07 AM
    To: pen-test@securityfocus.com
    Subject: oracle VA/PT

    Hi to all.

    Some day ago I was quite surprised to see that on a server that was
    scanned with nessus and with emaze scanner that revealed no relevant
    security hole, there was oracle installed and active with all the
    default oracle user/password activated (i.e. system/manager,
    scott/tiger, etc).

    What VA tool can find default user on oracle? Is it possible to find
    that info with Nessus (perhaps I can't use it at its best)?

    Best Regards,
                    Massimo
    PS
    I usually activate all the check on nessus and emaze.

    ------------------------------------------------------------------------
    ------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on
    your
    website. Up to 75% of cyber attacks are launched on shopping carts,
    forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers
    are
    futile against web application hacking. Check your website for
    vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before
    hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    ------------------------------------------------------------------------
    -------

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Bernhard Mueller: "Re: MS SQL, find list of tables"

    Relevant Pages

    • RE: Nessus - open or closed source?
      ... Does Nessus hit on something that ISS missed, yes sometimes, ... > Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping ... Check your website ...
      (Pen-Test)
    • Re: Vuln Scanning software choices
      ... The more people who use and contribute to the GPL fork of Nessus, ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... > Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • RE: oracle VA/PT
      ... OAT is another good one for Oracle checks ... Absinthe is for SQL injection- ... >Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • Re: oracle VA/PT
      ... You can get OAT (oracle auditing tool) at cqure.net ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... > Hackers are concentrating their efforts on attacking applications on ... Up to 75% of cyber attacks are launched on shopping ...
      (Pen-Test)
    • Re: Nessus - open or closed source?
      ... While I cannot state who I work for due to security reasons, ... whether it be nessus or others. ... > Audit your website security with Acunetix Web Vulnerability Scanner: ... Up to 75% of cyber attacks are launched on shopping carts, forms, ...
      (Pen-Test)