Hackproofing Oracle Application Server

Hackproofing Oracle Application Server
(A Guide to Securing Oracle 9)
David Litchfield(david@ngssoftware.com)
www.ngssoftware.com


NGSSoftware Insight Security Research Contents
Introduction
Oracle Architecture
Oracle Apache
PL/SQL
Buffer Overflows
Directory Traversal
Administration
OWA_UTIL package
PL/SQL Authentication By-pass
PL/SQL Cross-site scripting
OracleJSP
Translation Files
JSP SQL Poisoning
Globals.jsa
Physical Path mapping
XSQL
XSQLConfig.xml Access
XSQL SQL Poisoning
XSQL Style Sheets
SOAP
SOAP Application Deployment
SOAP Configuration File
SAMPLES
Dangerous Samples
DEFAULTS
Dynamic Monitoring Services
Perl Alias
TNS LISTENER
Listener Security Issues
EXTPROC and External Procedures
Oracle Database
PL/SQL External Procedures
Default User Logins and Passwords
Appendix A
2