Hacking the world’s most popular database

About this video

NetworkChuck builds an Oracle Database 23c Free instance in Docker and then demonstrates how an ethical hacker might approach it, stressing permission-only testing and that the database is only hackable because he configures it that way. He installs Docker on Ubuntu, runs the Oracle container on port 1521, enters it and connects with SQLPlus as SYSDBA. He explains Oracle’s multi-tenant model: a container database (CDB root) holding pluggable databases (PDBs), each with its own users, schemas and tablespaces, and notes a schema is created automatically with a user. He creates a PDB called the matrix, opens it, creates admin user Neo, grants create session, create table and unlimited tablespace, creates a table, and inserts, selects, updates and deletes rows with commit. He then demos 23c JSON relational duality: creating a duality view joining relational tables so data can be read and inserted as JSON and the underlying tables update, and vice versa. For the hacking section he runs the ODAT tool in Docker, uses its tnscmd module to ping the TNS listener, its SID guesser to find the SID, and its password guesser to brute-force logins. He acknowledges cheating by adding the known SID and the weak SYS password to ODAT’s wordlists, concluding that with SYSDBA credentials found this way an attacker could connect via SQLPlus, but that a properly configured 23c would be much harder to break.

Key takeaways

• Oracle uses a multi-tenant CDB/PDB model: pluggable databases are movable, isolated databases inside a container database, each tied to users and schemas
• A local Oracle 23c Free lab can be run as a Docker container and administered with SQL*Plus on listener port 1521
• Basic workflow shown: create and open a PDB, create a user, grant create session/table and tablespace, then create tables and use insert/select/delete with commit
• 23c JSON relational duality views let the same data be worked with as relational tables or as JSON documents, with changes reflected both ways
• ODAT can enumerate an Oracle target by pinging the TNS listener, guessing the SID and brute-forcing credentials — the demo only succeeds because the SID and weak password were planted in its wordlists

Episode details: published September 14, 2023 · 35:42 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: how did I NOT know about this? · Next: the Raspberry Pi 5 →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube