Video: Free tool for hacking Oracle databases


Video: Free tool for hacking Oracle databases

Ian Grant

Open source security testers will release a free tool that simplifies and automates hacking of Oracle databases at the Black Hat conference in Las Vegas next week.

The Oracle database is popular with large corporations and governments for recording large volumes of online transactions.

The hacking tool was developed in the open source Metasploit cooperative, which will host a seminar at the conference. According to the Metasploit website, students will learn how to create custom modules to solve specific tasks, launch widescale client-side attacks, operate a malicious wireless access point, generate custom backdoors, bypass intrusion prevention systems, and automate the post-exploitation process. The course shows how to use new features in the Metasploit softwre for penetration tests.

In February security researcher and Metasploit co-developer Chris Gates, who runs the Carnal0wnage website, showed how to attack Oracle using Metasploit. A video of the attack (below) was posted on the Toolbox for IT blog.

Attacking Oracle with the Metasploit Framework Shmoocon Firetalk Demo Video from carnal0wnage on Vimeo.

Reuters reported that Oracle has released a patch that protects against Metasploit. However, many firms are lax about applying patches, opening their information to hackers.

Metasploit has created other tools to hack other software programs, including Microsoft Windows, Apple's OSX, Linux and Posix operating systems, as well as the Firefox and Internet Explorer browsers and applications such as Office and Adobe's PDF applications.

Meanwhile, Mandiant, another security firm, says it has developed a tool that can detect Metasploit attacks. It says Metasploit's Meterpreter software lets developers write code in DLL files and execute everything in memory. This means nothing is written to disk where it might be detected.

Testers and hackers can use Meterpreter to download and upload files, execute code, and open its own command shell. The new tool can tell if Meterpreter is still in memory, and, if so, which files Meterpreter has accessed, and whether it has changed a registry key.

Email Alerts

Register now to receive IT-related news, guides and more, delivered to your inbox.
By submitting your personal information, you agree to receive emails regarding relevant products and special offers from TechTarget and its partners. You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

COMMENTS powered by Disqus  //  Commenting policy