Hacking the Oracle Application Framework
summary
Shows a real exploit that lets an attacker impersonate any active user by setting an OA Developer/OA Diagnostic cookie to 1, and documents finding plaintext passwords in the database and a dumpable list of active sessions. Uses Oracle evaluation VMs (~238 GB), Toad, Eclipse+InstaSearch, JD-GUI, custom scripts like extract.pl and organize_classes, Burp and FindBugs, and live log monitoring to reverse engineer 325,000 classes and ~300,000 XML files. Builds debug JSPs to enumerate session variables and demonstrates exploitable XSS, path traversal and dynamic SQL vectors.
AI-written summary · about
chapters (4)
- 0:00Start
- 5:08Target System • Oracle provides evaluation VMs (the only benefit to choosing this software) • 238 GB (before file system compression) • Setting it up is complex and beyond this presentation
- 28:37Inside to Outside (reverse taint checking) • Identify key internal functions prone to misuse • Trace execution/data flow to the data's source or until proper validation is discovered • Advantages: - Can focus on specific vulnerability classes • Disadvantages: - Difficult to identify exploit path with complex
- 33:19Outside to Inside (taint checking) • Identify external accessible interfaces • Trace execution and data flow • Identify vulnerable handling of user data • Advantages: - Easier to exploit • Disadvantages: - Many dead-ends
related talks
51mMaking the most of Security Tests
50mHackproofing Oracle Ebusiness Suite
43mLive hacking: Breaking into your Java web app
40mLive hacking: Breaking into your web app
23mMight As Well JUMP: Exploit Development For Java Serialization
40mA New Attack Interface in Java Applications
01h 02mLive Hacking: Breaking into your Web App
01h 06mLive hacking: Breaking into your Java web app