Databases

SQL Server

WEB

Demonstrate ability to execute operating system commands without xp_cmdshell

Industry Roles:

Assessment Methods:

Understands the difference between local SQL Server accounts and integrated auth, an the security implications of both

Industry Roles:

Assessment Methods:

Can identify running databases using from the SQL browser service

Industry Roles:

Assessment Methods:

Database Connectivity

WEB

Can recognise common database connection string formats, e.g. JDBC

Industry Roles:

Assessment Methods:

Understands common connection and authentication methods used by web applications to connect to database servers

Industry Roles:

Assessment Methods:

Other Databases

WEB

Understands and can demonstrate how access can be gained to such a database server through the use of default accounts credentials and insecure passwords

Industry Roles:

Assessment Methods:

Understands and can demonstrate the remote exploitation of common no-SQL database servers, such as MongoDB

Industry Roles:

Assessment Methods:

Understands and can demonstrate the remote exploitation of other common SQL database servers, such as MySQL and PostgreSQL

Industry Roles:

Assessment Methods:

Can identify and extract useful information stored within a database (e.g. user account names and passwords, recovering passwords where possible)

Industry Roles:

Assessment Methods:

Oracle

WEB

Following the compromise of an Oracle database server, can use stored procedures to execute system commands, escalate privileges ,read/write from/to the file system, and/or gain further access to a host

Industry Roles:

Assessment Methods:

Understands and can demonstrate how access can be gained to an Oracle database server through the use of default accounts credentials and insecure passwords

Industry Roles:

Assessment Methods:

Can demonstrate how the software version and patch status can be obtained from an Oracle database

Industry Roles:

Assessment Methods:

Understands the security attributes of the Oracle TNS Listener service

Industry Roles:

Assessment Methods:

Understands and can demonstrate the remote exploitation of an Oracle database

Industry Roles:

Assessment Methods:

Can identify and extract useful information stored within a database (e.g. user account names and passwords, recovering passwords where possible)

Industry Roles:

Assessment Methods:

Reconnaissance

WEB

Following the compromise of Microsoft SQL server, can use stored procedures to execute system commands, escalate privileges, read/write from/to the file system, and/or gain further access to a host

Industry Roles:

Assessment Methods:

Can identify and extract useful information stored within a database (e.g. user account names and passwords, recovering passwords where possible)

Industry Roles:

Assessment Methods:

Understands and can demonstrate how access can be gained to a Microsoft SQL server through the use of default accounts credentials and insecure passwords

Industry Roles:

Assessment Methods:

Understands and can demonstrate the remote exploitation of Microsoft SQL Server

Industry Roles:

Assessment Methods:

Please wait...