diff options
author | Christian Cleberg <hello@cleberg.net> | 2024-04-29 14:18:55 -0500 |
---|---|---|
committer | Christian Cleberg <hello@cleberg.net> | 2024-04-29 14:18:55 -0500 |
commit | fdd80eadcc2f147d0198d94b7b908764778184a2 (patch) | |
tree | fbec9522ea9aa13e8105efc413d2498c3c5b4cd6 /content/blog/2023-09-19-audit-sql-scripts.md | |
parent | d6c80fdc1dea9ff242a4d3c7d3939d2727a8da56 (diff) | |
download | cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.tar.gz cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.tar.bz2 cleberg.net-fdd80eadcc2f147d0198d94b7b908764778184a2.zip |
format line wrapping and fix escaped characters
Diffstat (limited to 'content/blog/2023-09-19-audit-sql-scripts.md')
-rw-r--r-- | content/blog/2023-09-19-audit-sql-scripts.md | 74 |
1 files changed, 33 insertions, 41 deletions
diff --git a/content/blog/2023-09-19-audit-sql-scripts.md b/content/blog/2023-09-19-audit-sql-scripts.md index b652a21..5801773 100644 --- a/content/blog/2023-09-19-audit-sql-scripts.md +++ b/content/blog/2023-09-19-audit-sql-scripts.md @@ -7,17 +7,16 @@ draft = false # Overview -When you have to scope a database into your engagement, you may be -curious how to best extract the information from the database. While -there are numerous different methods to extract this type of -information, I\'m going to show an example of how to gather all users -and privileges from three main database types: Oracle, Microsoft SQL, -and MySQL. +When you have to scope a database into your engagement, you may be curious how +to best extract the information from the database. While there are numerous +different methods to extract this type of information, I'm going to show an +example of how to gather all users and privileges from three main database +types: Oracle, Microsoft SQL, and MySQL. # Oracle -You can use the following SQL script to see all users and their -privileges in an Oracle database: +You can use the following SQL script to see all users and their privileges in an +Oracle database: ``` sql SELECT @@ -37,23 +36,21 @@ WHERE grantee IN (SELECT DISTINCT grantee FROM dba_tab_privs); ``` -This script queries the `dba_sys_privs` and -`dba_tab_privs` views to retrieve system and table-level -privileges respectively. It then combines the results using -`UNION ALL` to show all users and their associated -privileges. Please note that this method does not extract information -from the `dba_role_privs` table - use the method below for -that data. +This script queries the `dba_sys_privs` and `dba_tab_privs` views to retrieve +system and table-level privileges respectively. It then combines the results +using `UNION ALL` to show all users and their associated privileges. Please note +that this method does not extract information from the `dba_role_privs` table - +use the method below for that data. -Please note that you might need appropriate privileges (e.g., DBA -privileges) to access these views, and you should exercise caution when -querying system tables in a production Oracle database. +Please note that you might need appropriate privileges (e.g., DBA privileges) to +access these views, and you should exercise caution when querying system tables +in a production Oracle database. ## Alternative Oracle Query -You can also extract each table\'s information separately and perform -processing outside the database to explore and determine the information -necessary for the audit: +You can also extract each table's information separately and perform processing +outside the database to explore and determine the information necessary for the +audit: ``` sql SELECT ** FROM sys.dba_role_privs; @@ -64,9 +61,8 @@ SELECT ** FROM sys.dba_users; # Microsoft SQL -You can use the following SQL script to see all users and their -privileges in a Microsoft SQL Server database -([source](https://stackoverflow.com/a/30040784)): +You can use the following SQL script to see all users and their privileges in a +Microsoft SQL Server database ([source](https://stackoverflow.com/a/30040784)): ``` sql /* @@ -217,8 +213,8 @@ ORDER BY # MySQL -You can use the following SQL script to see all users and their -privileges in a MySQL database: +You can use the following SQL script to see all users and their privileges in a +MySQL database: ```sh mysql -u root -p @@ -230,26 +226,22 @@ Find all users and hosts with access to the database: SELECT ** FROM information_schema.user_privileges; ``` -This script retrieves user information and their associated -database-level privileges from the -`information_schema.user_privileges` table in MySQL. It lists -various privileges such as SELECT, INSERT, UPDATE, DELETE, CREATE, and +This script retrieves user information and their associated database-level +privileges from the `information_schema.user_privileges` table in MySQL. It +lists various privileges such as SELECT, INSERT, UPDATE, DELETE, CREATE, and more for each user and database combination. -Please note that you may need appropriate privileges (e.g., -`SELECT` privileges on -`information_schema.user_privileges`) to access this -information in a MySQL database. Additionally, some privileges like -GRANT OPTION, EXECUTE, EVENT, and TRIGGER may not be relevant for all -users and databases. +Please note that you may need appropriate privileges (e.g., `SELECT` privileges +on `information_schema.user_privileges`) to access this information in a MySQL +database. Additionally, some privileges like GRANT OPTION, EXECUTE, EVENT, and +TRIGGER may not be relevant for all users and databases. ## Alternative MySQL Query -You can also grab individual sets of data from MySQL if you prefer to -join them after extraction. I have marked the queries below with -`SELECT ...` and excluded most `WHERE` clauses for -brevity. You should determine the relevant privileges in-scope and query -for those privileges to reduce the length of time to query. +You can also grab individual sets of data from MySQL if you prefer to join them +after extraction. I have marked the queries below with `SELECT ...` and excluded +most `WHERE` clauses for brevity. You should determine the relevant privileges +in-scope and query for those privileges to reduce the length of time to query. ``` sql -- Global Permissions |