Pete Finnigan's Oracle Security Weblog

I talked about Alex's recent Oracle rootkit presentation last night here in my blog yesterday and also about his companies new tool repscan that can be used to check that a database has not been altered. This is done by generating a baseline of checksum values for each dictionary object. This baseline needs to be generated offline to ensure its security - e.g. so that it is not tampered with and also so that the database used for the baseline can be guaranteed to be clean and not again tampered with.

You can download a trial version of repscan from Alex's site and test it. Before you can run it some configuration is needed first, see repscan.txt for instructions. The databases.xml file and exec.xml file need to be configured. Then run generate.cmd from the command line to generate a baseline. This is held in \signatures. Then run check.cmd to test if the dictionary objects have been changed in anyway. A sample run is here:

C:\petefinnigan.com\blog\repscan>generate
Generating signatures
Signature files location: signatures\
Error messages will be in: errors\gen_errors.txt
Repscan 1.01
Latest version of Repscan is available from

C:\petefinnigan.com\blog\repscan>check
Checking databases
Report file: scanreport.xml
Error messages will be in: errors\chk_errors.txt
Repscan 1.01
Latest version of Repscan is available from

The report is saved as scanreport.xml and can be viewed in a browser. I won't show mine here.

I have updated my Oracle security tools page to include details of repscan.