Advanced Exploitation of Oracle PL/SQL Flaws

Source: www.blackhat.com
Topic: Oracle Programming

Short Desciption:
NGS Consulting Next Generation Security Software Ltd. What is PL/SQL? What is PL/SQL? • Procedural Language / Structured Query Language • Oracles extension to standard SQL Programmable like T-SQL ...

 

Content Inside:
NGS Consulting Next Generation Security Software Ltd. Advanced Exploitation of Oracle PL/SQL Flaws David Litchfield (davidl@ngssoftware. com) NGS Consulting Next Generation Security Software Ltd. Objectives Objectives • Discuss current "threat landscape" • Introduce a new class of vulnerability • Introduce a new method of attack • Show practical demonstrations • Look at some defences NGS Consulting Next Generation Security Software Ltd. Agenda Agenda • PL/SQL Risks • SQL Injection • "Dangling" Cursor Snarfing • Cursor Injection • Demonstrations • Grant DBA Privileges • Indirect Privilege Escalation NGS Consulting Next Generation Security Software Ltd. What is PL/SQL? What is PL/SQL? • Procedural Language / Structured Query Language • Oracles extension to standard SQL Programmable like T-SQL in the Microsoft world. • Used to create • Stored Procedures • Functions • Packages (collections of procedures and functions) • Triggers • Objects • Extends functionality with External Procedures and Java NGS Consulting Next Generation Security Software Ltd. Privileges - Definer vs. Invoker rights Privileges - Definer vs. Invoker rights • PL/SQL executes with the privileges of the definer • A procedure owned by SYS executes with SYS privileges • AUTHID CURRENT_USER keyword • PL/SQL created using the AUTHID CURRENT_USER keyword executes with the privileges of the invoker • A procedure owned by SYS but called by SCOTT executes with the privileges of SCOTT • Analogous to Suid programs in the *nix world. NGS Consulting Next Generation Security Software Ltd. Running SQL from PL/SQL Running SQL from PL/SQL • EXECUTE IMMEDIATE … • OPEN • DBMS_SQL • Key to Cursor Snarfing and Cursor Injection NGS Consulting Next Generation Security Software Ltd. DBMS_SQL DBMS_SQL DECLARE MY_CURSOR NUMBER; MY_RESULT NUMBE ...

 

 

oracle pl sql advanced pdf, cursor in oracle tutorial pdf, pl sql video tutorial, can i see dangling cursor in oracle, free oracle pl sql tutorial video, video tutorial on pl sql, oracle pl sql advanced tutorial pdf pl sql tutorial, advanced pl sql faq pdf, advanced exploitation of oracle pl sql flaws, ngs advanced exploitation of oracle pl sql flaws