Call: +44 (0)7759 277220 Call

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "identity theft and database security"] [Next entry: "Pete's audit scripts updated"]

Alex Kornbrusts repscan tested and added to oracle security tools page

I talked about Alex's recent Oracle rootkit presentation last night here in my blog yesterday and also about his companies new tool repscan that can be used to check that a database has not been altered. This is done by generating a baseline of checksum values for each dictionary object. This baseline needs to be generated offline to ensure its security - e.g. so that it is not tampered with and also so that the database used for the baseline can be guaranteed to be clean and not again tampered with.

You can download a trial version of repscan from Alex's site and test it. Before you can run it some configuration is needed first, see repscan.txt for instructions. The databases.xml file and exec.xml file need to be configured. Then run generate.cmd from the command line to generate a baseline. This is held in \signatures. Then run check.cmd to test if the dictionary objects have been changed in anyway. A sample run is here:

Generating signatures
Signature files location: signatures\
Error messages will be in: errors\gen_errors.txt
Repscan 1.01
Latest version of Repscan is available from

Checking databases
Report file: scanreport.xml
Error messages will be in: errors\chk_errors.txt
Repscan 1.01
Latest version of Repscan is available from

The report is saved as scanreport.xml and can be viewed in a browser. I won't show mine here.

I have updated my Oracle security tools page to include details of repscan.