Re: Pentesting on databases?

Hi mate,

take a look at:
http://www.symantec.com/connect/articles/secure-mysql-database-design

However, if the database is already running on production environment,
I suggest you use some of these tools:

http://www.ngssecure.com/services/information-security-software/ngs-squirrel-for-sql-server.aspx
http://www.ngssecure.com/services/information-security-software/ngs-squirrel-for-informix.aspx
http://www.ngssecure.com/services/information-security-software/ngs-squirrel-for-sybase-ase.aspx
http://www.ngssecure.com/services/information-security-software/ngs-squirrel-for-oracle.aspx
http://www.ngssecure.com/services/information-security-software/ngs-squirrel-for-db2.aspx

These tools analyze databases looking for security issues,
misconfigurations, etc. Very easy to use and powerful.

Hope this help.

Cheers
Ramiro


On Wed, Mar 21, 2012 at 4:31 AM, stayp0s <[email protected]> wrote:
>
> Hi list,
>
> I'm planning do a pen testing to ensure running databases(mysql,
> postgreSQL, and so on) are secure.
> Anyone has useful reference guidelines about that?
>
> Thank you!
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------