{"id":560,"date":"2015-01-26T21:32:18","date_gmt":"2015-01-26T13:32:18","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=560"},"modified":"2015-01-26T21:32:27","modified_gmt":"2015-01-26T13:32:27","slug":"oat-oracle-auditing-tools-database-security","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/01\/oat-oracle-auditing-tools-database-security\/","title":{"rendered":"OAT – Oracle Auditing Tools For Database Security"},"content":{"rendered":"

Oracle Auditing Tools is a tool kit that could be used to audit security within Oracle database servers.<\/p>\n

OAT uses CREATE LIBRARY to be able to access the WinExec function in the kernel32.dll in Windows or the system call in libc on Un*x. Having access to this function makes it possible to execute anything on the server with the same security context as the user who started the Oracle Service. So basically all accounts with default passwords, or easy guessable password, having this privilege can do this.<\/p>\n

\"Oracle<\/p>\n

OAT has a builtin TFTP server for making file transfers easy. The Tools are Java based and were tested on both Windows and Linux. They should hopefully also run on any other Java platform.<\/p>\n

We don’t write about many Oracle tools as they tend to be a bit ‘Enterprise’ but we did cover ODAT and way before that OAPScan:<\/p>\n

– ODAT (Oracle Database Attacking Tool) \u2013 Test Oracle Database Security<\/a>
\n– OAPScan \u2013 Oracle Application Server Scanner<\/a><\/p>\n

Contains<\/h3>\n