Oracle DB vulnerabilities: the missing pentester handbook

Date: 29/07/2015

Author:

Outer Perimeter: The Listener is under Attack

Those who ever came across this database know that Oracle DB interacts with its external environment by using a listener, which is a kind of balancer. The listener listens to port 1521 and resolves incoming connections depending on the requested database. One listener allows you to serve different databases. Also, in some cases, it allows to launch DoS and RCE attacks against the server. The audit of an Oracle database usually begins with attacks against the listener service. A priority task that you need to resolve in order to connect to the listener is to get SID, a kind of unique database identifier. Without it, the listener will not communicate with you. Sh2kerr once wrote an excellent research paper on this subject (Different ways to guess Oracle database SID).

Read full article →

7 non-trivial ways to hack your MySQL Database

Date: 20/07/2015

Author:

We will start with a definition. MySQL is a relational database management system with different data storage engines, such as MyISAM, InnoDB, Archive and others. Like most open source projects, it has its own branches, for example, MariaDB. Before going into details, I would like to mention that most of discussed vectors/techniques/bugs apply to various engines and branches, though not always.

Read full article →

Dive into exceptions: caution, this may be hard

Date: 15/07/2015

Author:

__try

Suppose that you are facing a practical task that requires a full implementation of exception handling in a code embedded in someone else’s process, or you are creating your next PE packer/cryptor to ensure the functionality of exceptions in an unpacked image. In any case, it all comes down to the fact that the code using the exceptions is executed outside the image projected by the system boot loader, which will be the main cause of your problems.

Read full article →

Building kernel modules and native Linux applications for Android

Date: 07/07/2015

Author:

As everybody knows, Android has the foundation of the Linux kernel. This implies that in theory you can run on a smartphone all the applications that are available on desktop Linux. In practice, everything is more difficult. Since the set of Native libraries in Android differs from that on the desktop (not to speak of the platform architecture), the applications need to be compiled statically. And sometimes to be patched, as well. But in this case too, the application operation is not always guaranteed.

Read full article →

Welcome, Sails.js! The Missing Rails for Node.js

Date: 15/06/2015

Author:

Node.js is really cool, but the abundance of powerful frameworks that simplify the development of web applications for other programming languages was a significant deterrent to the popularity of the use of JavaScript on servers. Many people needed a simple tool, one like your favorite RoR, Yii or ASP .NET MVC. The community of JavaScript aficionados worked hard on correcting this unfortunate situation, and several interesting solutions emerged as a result. Each of them has their own arsenal of killer-features, but in all that diversity I was attracted by an ambitious project hidden under modest title Sails.js.

Read full article →

Full kit of a Security Officer for $100

Date: 09/06/2015

Author:

Our goal is to collect a kind of carry-on criminalistic handbag that would be available to general public as long as be compact, obtainable and legal.

So, all the gadgets in out kit are supposed to correspond to further parameters:

  • Legality
    Which means an absolute legitimacy in terms of purchase, transportation, and storage of gadgets. The usage stands slightly isolated, because, for example, we can use certain devices absolutely legally anywhere, while the usage of some other ones in terms of special institutions, or against certain individuals, and moreover, for personal purposes could end up with administrative or criminal responsibility.
  • Cheapness
    Quite important parameter. As a rule, we can get anything, it is always just the matter of price. Well, the devices that we are going to review in the article have quite moderate price range available for most people.
  • Accessibility
    Anyone could find all the components with little effort, which is to say except those that are designed for certain certified organisations, legal persons, furthermore, except those gadgets and devices that could be distributed only on designated area.
  • Easy handling
    In my opinion, this is one of the most important parameters. That means that anyone could use a gadgets after briefing.
  • Portability
    Here, everything is obvious: small size, light weight in order to ergonomic placement in our criminalistic handbag or organizer, as long as workability.
  • Portability
    That means the gadget could work off-line or urges for minimum requirements and little dependence on other devices. For example it could work on different software, in case if it is supposed to be connected to a computer or smartphone.

Read full article →

Complete guide for *nix backup solutions

Date: 01/06/2015

Author:

The aspect of backup saving (and storage) is, certainly, one of the most important in the world of information: why would anyone want to lose his/her data as a result of the error (whether software or hardware error)? Since, there is a wide array of backup tools. I list the most necessary requirements, in my view, to these tools:

  • Ease of automation and the very existence of such. However, this requirement is almost completely balanced by the presence of Cron in all the general purpose *nix distributives. Still, backing up is just the very case when you should not put all your eggs in one basket.
  • Supported media and network backups. A backup tool can be arbitrarily remarkable, but if it supports only a limited set of media available for storing backups, then it is not worth a button. Creation of backups via network (including cloud) storages stands alone. Here appears the aspect of encryption and transmission of data and of backups themselves.
  • Ease of recovery. I suppose, comments are needless here, because if the loss of data has occurred, its recovery should be as quick and painless as possible.
  • Ease of initial configuration. This requirement is, of course, debatable since backup creation is configured only once. However, people often make a choice in favor of far less functional tools only because of their simplicity.

I did not make it a point to describe in details this or that tool — it is possible to write a separate book or at least an article almost about each of them. Here is just a brief overview of them.

Read full article →