Chapter 5. Auditing Databases

Note

This chapter shows you how to do some things that in many situations might be illegal, unethical, a violation of the terms of service, or just not a good idea. It is provided here to give you information that may be of use to protect yourself against threats and make your own system more secure. Before following these instructions, be sure you are on the right side of the legal and ethical line... use your powers for good!

In this chapter, we will cover:

• Listing MySQL databases

• Listing MySQL users

• Listing MySQL variables

• Finding root accounts with empty passwords in MySQL servers

• Brute forcing MySQL passwords

• Detecting insecure configurations in MySQL servers

• Brute forcing Oracle passwords

• Brute forcing Oracle SID names

• Retrieving MS SQL server information

• Brute forcing MS SQL passwords

• Dumping the password hashes of an MS SQL server

• Running commands through the command shell on MS SQL servers

• Finding sysadmin accounts with empty passwords on MS SQL servers

• Listing MongoDB...