Pete Finnigan's Oracle Security Weblog

I was looking for something on google last week and whilst searching I came across a page on Marcel-Jan Krijgsman's site. I actually found it as a cached link on GotRoot.com but I went to look directly at Marcel-Jan's site.

Marcel-Jan is the original author of the scripts on my site for checking Oracle's default passwords that are still set. My page Oracle Default Password Auditing Tool includes this PL/SQL tool. Marcel-Jan's tool that I found is called SQLGotcha 2.0 and looks quite useful. I have not had time to download the scripts yet but I will do so. A brief description of its functionality is included in the page stated. Basically Marcel-Jan wanted to be able to easily trace sessions without finding the sid and serial#. You can specify username, machine, program, Unix PID or even a table that is being accessed. The tool also has a waiting mode and can trace standard SQL Trace or event 10046 tracing. The tool can be used to keep track of traces that have been started and also to find the file name. Marcel-Jan warns that using the tool can be costly in terms of querying the dictionary. I like the idea that you can specify the tool should wait for a particular session to start-up and it will then trace it.

I am particularly interested in trace tools and tracing sessions as trace can be used to learn more about how Oracle or applications operate. This can be very useful for security investigations. I have written a paper some time back that describes many ways to set trace for your own session, others sessions and also at various different levels. It also covers all the known ways to enable and disable trace. The paper is called "How to set trace for others sessions, for your own session and at instance level".