Exploiting Search Engines for Attacking Database Exposed to Internett.
Ayad, N., Klash, H., Sorour, H. (2012). Exploiting Search Engines for Attacking Database Exposed to Internett.. EKB Journal Management System, 22(1), 1-12. doi: 10.21608/mjeer.2012.66887
N. M. A. Ayad; H. M. Klash; H. Sorour. "Exploiting Search Engines for Attacking Database Exposed to Internett.". EKB Journal Management System, 22, 1, 2012, 1-12. doi: 10.21608/mjeer.2012.66887
Ayad, N., Klash, H., Sorour, H. (2012). 'Exploiting Search Engines for Attacking Database Exposed to Internett.', EKB Journal Management System, 22(1), pp. 1-12. doi: 10.21608/mjeer.2012.66887
Ayad, N., Klash, H., Sorour, H. Exploiting Search Engines for Attacking Database Exposed to Internett.. EKB Journal Management System, 2012; 22(1): 1-12. doi: 10.21608/mjeer.2012.66887

Exploiting Search Engines for Attacking Database Exposed to Internett.

Menoufia Journal of Electronic Engineering Research
Article 2, Volume 22, Issue 1, January 2012, Page 1-12  XML
DOI: 10.21608/mjeer.2012.66887
View on SCiNiTO View on SCiNiTO
Authors
N. M. A. Ayad1; H. M. Klash2; H. Sorour2
1Computer & Network, Reactor Department Atomic, Energy Authority
2Dept. of Computer Science and Eng., Faculty of Elect., Eng., Minufiya University
Abstract
Database security has recently become a victim of misused search engines. Hackers use search engines to find potentially vulnerable web applications to attack. The search engine doesn’t actually execute any attacks; rather it is used to quickly locate “soft targets” among the vast number of sites on the internet. Hackers have started to use search engines to find web facing database interfaces that can be used to mount attacks on databases placed behind a firewall. This is a significant new development, completely exposing previously “protected” databases to outside attack. This paper shows how hacker can target the vulnerable sites with attacks designed to exploit the specific holes discovered by the search engine
References
[1]           "Google: Net Hacker Tool du Jour", Christopher, 2004. http://www.wired.com/news/infostructure/0,1377,57897,00.html

[2]           "ISQLPlus", [Online]. Available: http://www.orafaq.com/wiki/ISQLPlus, May 10, 2010.

[3]            "Oracle Database: a Security Perspective", Henrique Moniz  Faculdade  de     Ciˆencias da Universidade de Lisboa Campo Grande, 1749-016 Lisboa  Portugalhmoniz@di.fc.ul.pt ,January 23, 2006

[4]           "Introduction to Oracle Security", Mikoláš Panský, March, 2007. Available: http://www.cleverlance.cz/NR/rdonlyres/27007B48-9360-4158-BE9A-46F7DF62CE94/633/oracle2.pdf .

[5]           "Hacking Oracle from the Web Exploiting SQL Injection from Web Applications", Sumit Siddharth, 2009.

[6]           "Oracle Security Alert 58", Severity: 1, Available: http://www.oracle.com/technetwork/topics/security/2003alert58-128165.pdf, April 15, 2011.

[7]           "SQL Injection", Available: http://sec4app.com/download/SqlInjection.pdf, June 15,  2011.

[8]           "Oracle Tip: Beware of iSQL*Plus vulnerabilities", By Scott Stephens, May 24, 2004,http://www.techrepublic.com/article/oracle-tip-beware-of-isqlplus-vulnerabilities/5219056

[9]            "Search engines used to attack databases", A. Newman, Technical report, Application Security, Inc. Available: http://www.appsecinc.com/presentations/Search_Engine_Attack_Database.pdf, April 15, 2011. 

[10]       "Oracle Default Password list", petefinnigan, Available: "http://www.petefinnigan.com/default/default_password_list.htm, May 4, 2011. 

[11]        "Oracle RDBMS passwords solver", Available: http://ops.conus.info:669/, January 15, 2011. 

[12]        Hardbeat How we defaced Available:  www.apache.org. http://www.dataloss.nl/papers/how.defaced.apache.org.txt, July 13, 2011. 

[13]        "Database Security - The Forgotten Threat", Available: http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=4123757, March 8, 2011. 

Statistics
Article View: 132