Difference between revisions of "Testing for Oracle"

From OWASP
Jump to: navigation, search
(Black Box testing and example)
(Gray Box testing and example)
Line 23: Line 23:
  
 
== Gray Box testing and example ==  
 
== Gray Box testing and example ==  
'''Testing for Topic X vulnerabilities:'''<br>
+
'''Testing for Authentication credential management:'''<br>
...<br>
+
* Unlimited failed login attempts<br>
 +
* Password Expiry
 +
* Password reuse
 +
* Unencrypted Database Link Password
 +
* Default Roles
 +
* PUBLIC Object Permissions
 +
* UTL Package Permissions
 +
* Default Tablespace
 +
 
 
'''Result Expected:'''<br>
 
'''Result Expected:'''<br>
 
...<br><br>
 
...<br><br>
 +
 
== References ==
 
== References ==
 
'''Whitepapers'''<br>
 
'''Whitepapers'''<br>

Revision as of 06:44, 28 November 2006

[Up]
OWASP Testing Guide v2 Table of Contents

Brief Summary


Testing an Oracle database server can be very beneficial to the security of the application. It is common that the database port (E.g. 1521) is protected by the firewall but can be accessible on the internal LAN. If the Oracle database is not hardened internal "insider attacks" may occur.

Description of the Issue


...here: Short Description of the Issue: Topic and Explanation

Black Box testing and example

Testing for Weak Account Passwords:
...
Result Expected:
...

Testing for Communication infrastructure & Availability:
...
Result Expected:
...

Gray Box testing and example

Testing for Authentication credential management:

  • Unlimited failed login attempts
  • Password Expiry
  • Password reuse
  • Unencrypted Database Link Password
  • Default Roles
  • PUBLIC Object Permissions
  • UTL Package Permissions
  • Default Tablespace

Result Expected:
...

References

Whitepapers
...
Tools
...


OWASP Testing Guide v2

Here is the OWASP Testing Guide v2 Table of Contents