This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Testing for Oracle"
(→Gray Box testing and example) |
(→Gray Box testing and example) |
||
Line 27: | Line 27: | ||
Check the FAILED_LOGIN_ATTEMPTS parameter: | Check the FAILED_LOGIN_ATTEMPTS parameter: | ||
+ | |||
+ | This can be achieved by ht e following SQL:<BR> | ||
+ | |||
+ | List security related profile information | ||
+ | |||
+ | conn / as sysdba | ||
+ | col profile format a20 | ||
+ | col limit format a20 | ||
+ | select profile, resource_name, limit | ||
+ | from dba_profiles | ||
+ | where resource_name like '%PASSWORD%' | ||
+ | or resource_name like '%LOGIN%'/ | ||
+ | |||
The FAILED_LOGIN_ATTEMPTS parameter is used to limit to the number of failed login attempts allowed before a user account is locked by the data base.<BR> | The FAILED_LOGIN_ATTEMPTS parameter is used to limit to the number of failed login attempts allowed before a user account is locked by the data base.<BR> |
Revision as of 11:57, 28 November 2006
[Up]
OWASP Testing Guide v2 Table of Contents
Brief Summary
Testing an Oracle database server can be very beneficial to the security of the application. It is common that the database port (E.g. 1521) is protected by the firewall but can be accessible on the internal LAN. If the Oracle database is not hardened internal "insider attacks" may occur.
Description of the Issue
...here: Short Description of the Issue: Topic and Explanation
Black Box testing and example
Testing for Weak Account Passwords:
...
Result Expected:
...
Testing for Communication infrastructure & Availability:
...
Result Expected:
...
Gray Box testing and example
Testing for Authentication credential management:
- Unlimited failed login attempts
Check the FAILED_LOGIN_ATTEMPTS parameter:
This can be achieved by ht e following SQL:
List security related profile information
conn / as sysdba col profile format a20 col limit format a20 select profile, resource_name, limit from dba_profiles where resource_name like '%PASSWORD%' or resource_name like '%LOGIN%'/
The FAILED_LOGIN_ATTEMPTS parameter is used to limit to the number of failed login attempts allowed before a user account is locked by the data base.
FAILED_LOGIN_ATTEMPTS can be set to a specific number of attempts; to UNLIMITED (never lock an account), to DEFAULT, which refers to the value indicated in the DEFAULT profile.
Setting this value reduces the potential success of a brute force attack and alerts. Once an account is locked it can not be logged into for a defined number of days or until the administrator unlocks the account.
- Password Expiry
- Password reuse
- Unencrypted Database Link Password
- Default Roles
- PUBLIC Object Permissions
- UTL Package Permissions
- Default Tablespace
Result Expected:
...
References
Whitepapers
...
Tools
...
OWASP Testing Guide v2
Here is the OWASP Testing Guide v2 Table of Contents