{"id":394,"date":"2019-04-08T22:23:31","date_gmt":"2019-04-08T15:23:31","guid":{"rendered":"http:\/\/www.seven-stones.biz\/blog\/?p=394"},"modified":"2019-04-08T22:24:52","modified_gmt":"2019-04-08T15:24:52","slug":"musang-oracle-security-testing-major-release","status":"publish","type":"post","link":"https:\/\/www.seven-stones.biz\/blog\/musang-oracle-security-testing-major-release\/","title":{"rendered":"Musang – Oracle DB Security Testing – v1.8"},"content":{"rendered":"\n

Musang is a Docker<\/a>-supplied Python\/Django project for authenticated security testing scans for Oracle Database, for on-premise, or cloud SaaS, PaaS or IaaS stacks.<\/p>\n\n\n\n

The last update of Musang (1.4) was in 2013! So this latest update (1.8) brings Musang into the modern age of old software by introducing support for 12c databases – after all i’m sure there are lots who upgraded from 9g. Right? <\/p>\n\n\n\n

No but seriously, Oracle Database 12c introduces the concept of Containers and Pluggable Databases (PDB). It also stores password hashes in a dramatically different way (The mighty Pete Finnegan explains about these hashes so I don’t have to)<\/a>. The user doesn’t have to lose sleep worrying about such things – Musang auto-detects Database versions and selects the corresponding library of tests. However the connection string passed to the Database has to use the right SID of course – do you want to connect to a container or PDB? <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Other major changes centred around Python 2.x going EOL<\/a> – and with it the shift to Django <\/a>2.x. <\/p>\n\n\n\n

An account privileges dump (for non-SYS, SYSTEM users) has been added also, and the output links each account to the account status (locked, expired, open, etc) – see below … <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

A rundown of the major changes…<\/p>\n\n\n\n