auxiliary scanners oracle_plsql_enabled

Author(s):

CG [carnal0wnage]

Description:

Checks to see if PL/SQL is enabled. If the server responds with a 200 OK response for the first request ("null") and a 404 Not Found for the second (something random) then it indicates that the server is running the PL/SQL Gateway. Pay careful attention to the /'s in URIPATH and DAD

References:

http://www.owasp.org/index.php/Testing_for_Oracle

Module Options:

DAD       portal/                           true       The Database Access Descriptor
PROXYA                                      false      Proxy IP Address
PROXYP                                      false      Proxy Port Number
RURL      http://www.example.com/test.php   true       Target address
URIPATH   /pls/                             true       The URI PATH

Options Explained (Module Specific):

URIPATH -- Path (before portal).

DAD -- The DAD can change per-site depending on what they've named it OR if they've left the default DAD in. Either way, change if necessary.

Real world example:

Our target is http://vulnoraclesappisembarassingitself.com and it has a DAD at portal. Leave the default setting. If changing, append the '/' after the name change. Example, if changing from portal to portal30,

set DAD portal30/

The same applies for pls only prepend and append. Example,

 set URIPATH /expls/
 set RURL http://vulnoraclesappisembarassingitself.com
 run