Oracle Use Cases

Oracle authentication records are used for authenticated scanning of Oracle database instances. It's possible to scan multiple Oracle instances on the same host and port.

Create a separate Oracle record for each of the Oracle instances you want to scan

In the Oracle record tell us the Oracle System ID (SID) for the database you want to authenticate to, and supply login credentials. The use cases below describe various configuration options.

Single Oracle Instance (SID A) on a Single Port (Port 1521)

Number of Records Needed: 1

You can either specify the port that the SID is running on or select the "All Ports" option.

Login Credentials

SID: A

Ports: All Ports or Port 1521

Assigned IPs: 10.10.10.1

Single Oracle Instance (SID A) on a Multiple Ports (Ports 1521 and 1527)

Number of Records Needed: 1

No Restricted Ports

If no ports are restricted, you can use the "All Ports" option. The scanning engine will attempt to authenticate to the SID on each port the Oracle service is detected on.

Login Credentials

SID: A

Ports: All Ports

Assigned IPs: 10.10.10.1

With Restricted Ports

If a port is restricted, meaning that you don't want it to be scanned, then do not use the "All Ports" option and instead specify a port that is not restricted. This is the only way to ensure that the restricted port is not scanned. For example, if Port 1521 is restricted and you don't want it to be scanned, then specify a different port like Port 1527 in the authentication record. In this case, the scanning engine will only attempt to authenticate to the SID on Port 1527.

Login Credentials:

SID: A

Ports: Port 1527

Assigned IPs: 10.10.10.1

Create a multiple Oracle records, one for each database instance you want to scan.

You can scan multiple instances on the same host and port.

Record 1 Login Credentials

SID: A

Ports: Port 1521

Assigned IPs: 10.10.10.1

Record 2 Login Credentials

SID: B

Ports: Port 1527

Assigned IPs: 10.10.10.1

Record 3 Login Credentials

SID: C

Ports: Port 1527

Assigned IPs: 10.10.10.1

 

Tell me about restricted ports

For non-authenticated vulnerability scans (without Oracle authentication enabled), we will attempt to connect to each port the Oracle instance is detected on in order to gather system information. In this case, there is no way to prevent restricted ports from being scanned. If Oracle is detected on Port 1521 and Port 1527, then we will scan both ports.