Making the most of Security Tests
summary
Red team discovers an XML-RPC jar on a share, decompiles it and finds a string concatenation to an IN clause that reaches an Oracle DB. Exploits progress from one-bit probes using DECODE and DUAL to full UNION-style selects, then use Oracle DECODE and USER_SOURCE reads to reconstruct a stored procedure, bypass a 4,000‑char limit, and inject SQL that writes payment-trigger rows. Attack achieves DBA escalation, SSH/ROOT on servers, and triggers live payments; the chain takes about a week and exposes gaps static and pen tests miss.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:35Risk Management metrics
- 6:29Assessment landscape
- 9:17Initial attack
- 11:56Reversing Java client
- 14:42xml-rpc invocation
- 17:37SQL select
- 18:44Educated guess
- 24:30SQL union
- 25:29Let's try UNION
- 27:25Invoke UNION
- 28:15What next?
- 30:59Stop guessing - just read it bit by bit
- 33:34Database source code
- 35:34White box injection
- 37:49privileges
- 40:55Post-credits scene
- 41:46The results
related talks
34mHacking the Oracle Application Framework
50mHackproofing Oracle Ebusiness Suite
51mOrion's Quest: Modern Pentesting
52mDevSecOps
36mSecurity - Only Developers Can Make It Proactive
43mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
40mFantastic Red-Team Attacks and How to Find Them