Two papers on Oracle 11g Security
Hey all,
Since there seems to be a fair bit of disinformation, and utter nonsense,
floating around since my talk at the Black Hat Federal security conference
the other day, I have decided to publish the following papers.
http://www.databasesecurity.com/HackingAurora.pdf
http://www.databasesecurity.com/ExploitingPLSQLinOracle11g.pdf
Whilst the papers were written on the 14th and 21st of October respectively,
Oracle were informed on these issues discussed in these papers on the 11th
and 13th of October 2009.
The slides from the talk can be found here:
http://www.databasesecurity.com/bh-DC2010.pdf
Cheers,
David Litchfield
相关文档：
假设有张表，叫table1，里面有5000万行数据，假设预计全表扫描1次需要1个小时，我们从过程来看：
1、在1点钟，有个用户A发出了select * from table1;此时不管将来table1怎么变化，正确的结果应该是用户A会看到在1点钟这个时刻的内容。这个是没有疑问的。
2、在1点30分，有个用户B执行了update命令，更新了table1表中的� ......
delete from tbl_talbe
where (col1,col2,col3) in
(select col1,col2,col3
from tbl_table
group by col1,col2,col3
&nbs ......
1
2
3
作者： 来源： 更新日期：2006-01-04
5
6
7
建立表空间
8
9
CREATE TABLESPACE data01
10
DATAFILE '/oracle/oradata/d ......
t表中将近有1100万数据，很多时候，我们要进行字符串匹配，在SQL语句中，我们通常使用like来达到我们搜索的目标。但经过实际测试发现，like的效率与instr函数差别相当大。下面是一些测试结果：
SQL> set timing on
SQL> select count(*) from t where instr(title,’手册’)>0;
COUNT(*)
—&md ......
