DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need immediate attention and identify configuration settings that should be reviewed for appropriateness. This tool is not for identifying SQL Injection vulnerabilities in an application, there are good tools available for that already (e.g. https://github.com/sqlmapproject ). Also, this tool does not attempt to determine what CVEs may impact the version of the target database (but may do so in the future - maybe). Rather, this tool can help you better understand the potential impact of a successful SQL Injection attack due to weak configuration or access controls. A majority of the checks are from the CIS ( https://cisecurity.org) Security Benchmarks for databases, so thanks to the CIS! The benchmark documents can be found here: https://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.servers.database
Finally, DbDat is intended to be a framework to enable easy creation of new plugins and checks. Contributions from the security, or even database administrator, community is what will make this a great tool. The current set of checks are in no way complete, certainly more needs to be done. Please contribute!
Developing New Database Checks
Pull requests are very welcome! Checks are organized by database type (e.g. MySQL, Oracle, MS SQL, etc.) in the plugins folder. Each check is a single python file that must have
check_ at the begining of the file name. Each file contains a class with a do_check method. This method is the primary logic for checks. The quick way to get started is to copy an existing check file and modify it. However, see the Developing Plugins section below for more details. Running DbDat
- Be sure you have the necessary dependencies installed for Python scripts to connect to your target database. See dependencies section below.
- Add a connection profile entry in the
etc/dbdat.conffile for each database you want to assess. - Run:
python dbdat.py -p <profile name> - View the report. To view the report
cdto reports directory and runpython -m SimpleHTTPServer 9000(or choose a port number you prefer). Then open your browser and navigate tohttp://localhost:9000.
python dbdat.py -h Report Output
The report organizes results by levels, which are RED, YELLOW, ORANGE, GRAY, and GREEN.
- RED - items needing immediate attention.
- YELLOW - items needing review.
- ORANGE - checks that failed to execute properly.
- GRAY - items that may not be applicable to the version of the database being assessed.
- GREEN - items that passed
Dependencies
So far DbDat has been tested on Debian Linux, CentOS Linux, and Windows 7 with Python 2.7
MySQL support
Run:
pip install MySQL-python Or on Debian, run:
apt-get install python-mysqldb PostgreSQL support
Run:
pip install psycopg2 Oracle support
Run:
pip install cx_Oracle Note: you will need to install Oracle client libraries for this to work.
MS SQL support
Run:
pip install pymssql Sybase support
- todo
DB2 support
Run:
pip install ibm_db or easy_install ibm_db Note: you will need to ensure the user running DbDat has access to execute DB2 CLP commands (e.g. db2 and db2level).
MongoDB support
Run:
pip install mongodb To support MongoDB YAML config files run:
pip install pyyaml CouchDB support
Run:
pip install couchdb