2KKUU7ita

Chapter 15
Databases and Storage Systems
In This Chapter
▶ Testing and exploiting database flaws
▶ Finding storage weaknesses
▶ Ferreting out sensitive information
▶ Countering database and storage abuse
A ttacks against databases and storage systems can be very serious
because that’s where “the goods” are located, and the bad guys are
well aware of that. These attacks can occur across the Internet or on the
internal network when external attackers and malicious insiders exploit any
number of vulnerabilities. These attacks can also occur via the web application
through SQL injection.
Diving into Databases
Database systems, such as Microsoft SQL Server, MySQL, and Oracle, have
lurked behind the scenes, but their value and their vulnerabilities have finally
come to the forefront. Yes, even the mighty Oracle that was once claimed
to be unhackable is susceptible to similar exploits as its competition. With
the slew of regulatory requirements governing database security, hardly any
business can hide from the risks that lie within because practically every
business (large and small) uses some sort of database.
Choosing tools
As with wireless, operating systems, and so on, you need good tools if you’re
going to find the database security issues that count. The following are my
favorite tools for testing database security:
✓ Advanced SQL Password Recovery (www.elcomsoft.com/asqlpr.
html) for cracking Microsoft SQL Server passwords