Two papers on Oracle 11g Security
Hey all,
Since there seems to be a fair bit of disinformation, and utter nonsense,
floating around since my talk at the Black Hat Federal security conference
the other day, I have decided to publish the following papers.
http://www.databasesecurity.com/HackingAurora.pdf
http://www.databasesecurity.com/ExploitingPLSQLinOracle11g.pdf
Whilst the papers were written on the 14th and 21st of October respectively,
Oracle were informed on these issues discussed in these papers on the 11th
and 13th of October 2009.
The slides from the talk can be found here:
http://www.databasesecurity.com/bh-DC2010.pdf
Cheers,
David Litchfield
相关文档：
1、su – oracle 不是必需，适合于没有DBA密码时使用，可以不用密码来进入sqlplus界面。
2、sqlplus /nolog 或sqlplus system/manager 或./sqlplus system/manager@ora9i;
3、SQL>connect / as sysdba ;（as sysoper）或
connect internal/oracle AS SYSDBA ;(scott/tiger)
conn sys/change_on_install as sysd ......
假设有张表，叫table1，里面有5000万行数据，假设预计全表扫描1次需要1个小时，我们从过程来看：
1、在1点钟，有个用户A发出了select * from table1;此时不管将来table1怎么变化，正确的结果应该是用户A会看到在1点钟这个时刻的内容。这个是没有疑问的。
2、在1点30分，有个用户B执行了update命令，更新了table1表中的� ......
1.准备工作：
安装32位或64位RHEL5.4，安装向导中不需要选任何组件，不需要预配置任何用户，IP是DHCP或静态皆可。
安装后配置额外组件：
yum -y install libXp,make,binutils,gcc,kernel-headers,glibc-headers,glibc-devel,libgomp
在x86_64上还需要compat-libstdc++-33.x86_64
对x86，上传并解压10201_database_lin ......
1
2
3
作者： 来源： 更新日期：2006-01-04
5
6
7
建立表空间
8
9
CREATE TABLESPACE data01
10
DATAFILE '/oracle/oradata/d ......
也许对SQL Server来说,取前N位的数据是很简单的事情,一条TOP语句就搞定了.
在Oracle中我们往往会感觉到头疼,平日里也常会用到,主要是使用partition by.
语法如下:
select emp_card_no,work_date,read_card_date,count(rownum) as cnt
from hra_read_car ......
