1. Home
  2. Networking
  3. Network security assessment

8.8 Database Services

Three popular SQL database services that are often found in small, medium, and large network environments are Microsoft SQL Server, Oracle, and MySQL, accessible through the following network ports:

ms-sql          1433/tcp

ms-sql-ssrs     1434/udp

ms-sql-hidden   2433/tcp

oracle-tns      1521/tcp

oracle-tns-alt  1526/tcp

oracle-tns-alt  1541/tcp

mysql           3306/tcp

In this half of the chapter, I discuss the remote enumeration, brute-force password-grinding, and process-manipulation attacks you can launch to gain access to these database services.



    		Network Security Assessment
    		Foreword
    		Preface
    		Chapter 1. Network Security Assessment
    		Chapter 2. The Tools Required
    		Chapter 3. Internet Host and Network Enumeration
    		Chapter 4. IP Network Scanning
    		Chapter 5. Assessing Remote Information Services
    		Chapter 6. Assessing Web Services
    		Chapter 7. Assessing Remote Maintenance Services
    		Chapter 8. Assessing FTP and Database Services
    		8.1 FTP
    		8.2 FTP Banner Grabbing and Enumeration
    		8.3 FTP Brute-Force Password Guessing
    		8.4 FTP Bounce Attacks
    		8.5 Circumventing Stateful Filters Using FTP
    		8.6 FTP Process Manipulation Attacks
    		8.7 FTP Services Countermeasures
    		8.8 Database Services
    		8.9 Microsoft SQL Server
    		8.10 Oracle
    		8.11 MySQL
    		8.12 Database Services Countermeasures
    		Chapter 9. Assessing Windows Networking Services
    		Chapter 10. Assessing Email Services
    		Chapter 11. Assessing IP VPN Services
    		Chapter 12. Assessing Unix RPC Services
    		Chapter 13. Application-Level Risks
    		Chapter 14. Example Assessment Methodology
    		Appendix A. TCP, UDP Ports, and ICMP Message Types
    		Appendix B. Sources of Vulnerability Information
    		Colophon