Mohamed Amine Sebaoune’s Post

Spring Boot Security Database Authentication Example https://lnkd.in/dk-xGkhK

Last week, I came across this post discussing the exploitation of an unpatched Oracle vulnerability: https://lnkd.in/e6XVg9vh. It got me thinking... can RASP (Runtime Application Self-Protection) or ADR (Application Detection and Response) prevent such exploits, even without prior knowledge of the vulnerability (0-day)? While programming languages like C suffer from a lack of memory safety, web applications typically contend with injection attacks. A significant amount of effort has been directed towards implementing taint analysis at runtime, often marketed under RASP. However, not all solutions can track data flow accurately, and RASP (or any taint engine) can lose taint information during runtime, potentially being bypassed. This typically happens when solutions fail to instrument primitives and arrays, leading to possible taint status loss. Identifying sources, sinks, and sanitizers is inherently complex. The variability in application servers (Tomcat, WebLogic…), frameworks (SpringBoot, Quarkus…), and libraries/APIs (Hibernate Reactive, Vert.x… ), along with the programming languages used, further complicates the task. RASP providers typically do not share detailed information about their solutions, which also explains the lack of literature on the topic. I compiled a technical post (https://lnkd.in/eHRk69Ef) explaining how the vulnerability (CVE-2022-21587) was discovered, how it can be exploited, and whether RASP or ADRs can protect against it and how. I remain convinced that RASP alone is not sufficient😶.

Another absolutely fantastic article from Mouad Kondah about visibility limitations in existing runtime application solutions - this is why I'm advocating for visibility that unites infrastructure and application layers, more on that this week! Why is this worth a new category? 1. Technical differentiation 2. Easier installation 3. Real security storyline benefits 4. Multi-layered detection capabilities with a single agent

🔍 SQL Injection Attack Lab: Listing Database Contents in Oracle Excited to share my latest lab experience where I explored SQL injection attacks, specifically focusing on how to list database contents in Oracle databases. IANT (Institute of Advance Network Technology)

🚨 SQL Injection Attack: Listing Database Contents on Oracle 🛡️ 🔐 Objective: Learn how SQL Injection vulnerabilities can be exploited to list database contents in Oracle databases. 💡 Key Takeaways: Demonstrating SQL Injection in SELECT operations Practical payloads for enumerating tables, columns, and data Defensive coding practices to mitigate SQL Injection threats 📂 Lab Contents: Vulnerable PHP page Oracle Database with multiple tables Sample Injection Payload: SELECT * FROM users WHERE username = 'admin' OR '1'='1'; 🔧 Tools Used: Oracle Database PHP/HTML for lab interface SQLmap (optional) 🔐 Mitigation Techniques: Prepared Statements Parameterized Queries Input Validation 👉 Check out my blog for full details and the complete lab setup! [https://lnkd.in/dReVGC43]

DAY 4: Lab name 'SQL Injection attack, listing the database contents on non-oracle databases' successfully tackled. I suppose in the upcoming days, I would still be solving SQL labs as the language is very much important in finding the SQL injection attacks and I believe the more time I will devote on labs, the more experience I will gain. Nonetheless, I will keep my connections updated about my progress Bye for now :D

SQL injection attack, listing the database contents on non-Oracle databases

If you understand how hackers can breach your PL/SQL then you can understand how to secure that same PL/SQL. Get expert live training taught on-line by Pete Finnigan on our popular 1 day class - Secure coding in PL/SQL. We have a live public class on the 10th July on UK time and also on the 11th July USA EST time. Details - https://lnkd.in/ds3GBK7 and to register - https://lnkd.in/dBbrfFe #oracleace #oracle #database #security #securecode #plsql #training

If you understand how hackers can breach your PL/SQL then you can understand how to secure that same PL/SQL. Get expert live training taught on-line by Pete Finnigan on our popular 1 day class - Secure coding in PL/SQL. We have a live public class on the 10th July on UK time and also on the 11th July USA EST time. Details - https://lnkd.in/ds3GBK7 and to register - https://lnkd.in/dBbrfFe #oracleace #oracle #database #security #securecode #plsql #training

🚀 Successfully Completed: SQL Injection Lab on Oracle Database! 🚀 I'm thrilled to share that I’ve successfully solved a challenging SQL injection lab focused on listing the database contents on an Oracle database. This lab was an excellent opportunity to apply and sharpen my skills in identifying and exploiting SQL injection vulnerabilities. 🔍 Lab Overview: The objective was to exploit an SQL injection vulnerability to retrieve database contents from an Oracle database. This involved understanding the intricacies of Oracle SQL syntax and leveraging it to perform unauthorized queries. 💡 Steps to Solve: Identify the Injection Point: Found a vulnerable input field that interacts with the database without proper validation or sanitization. Craft the SQL Payload: Used a payload to extract the list of tables: sql Copy code ' UNION SELECT table_name, NULL FROM all_tables WHERE 1=1 -- Retrieve Columns and Data: Once tables were listed, crafted further payloads to list columns and extract data: sql Copy code ' UNION SELECT column_name, NULL FROM all_tab_columns WHERE table_name='USERS' -- ' UNION SELECT username, password FROM users -- Bypass Filters and Restrictions: Implemented techniques to bypass any potential input filtering or output encoding mechanisms. Analyze and Extract Data: Successfully retrieved sensitive information and analyzed the database structure. 🔧 Tools Used: Burp Suite for intercepting and modifying requests. SQLMap for automated SQL injection and database extraction. Manual Payload Crafting to understand and exploit specific Oracle SQL behaviors. 🎯 Key Takeaways: Importance of robust input validation and parameterized queries to prevent SQL injection. Deepened understanding of Oracle-specific SQL injection techniques. Reinforced the significance of continuous learning and hands-on practice in cybersecurity. 🌟 Next Steps: Applying these skills in real-world scenarios to ensure secure application development. Continuing to participate in advanced labs and CTFs to further hone my penetration testing skills. 🔗 #CyberSecurity #PenetrationTesting #SQLInjection #Oracle #WebSecurity #BugBounty #EthicalHacking #InfoSec #ContinuousLearning