DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need immediate attention and identify configuration settings that should be reviewed for appropriateness. This tool is not for identifying SQL Injection vulnerabilities in an application, there are good tools available for that already (e.g. https://github.com/sqlmapproject ). Also, this tool does not attempt to determine what CVEs may impact the version of the target database (but may do so in the future - maybe). Rather, this tool can help you better understand the potential impact of a successful SQL Injection attack due to weak configuration or access controls. A majority of the checks are from the CIS ( https://cisecurity.org) Security Benchmarks for databases, so thanks to the CIS! The benchmark documents can be found here: https://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.servers.database
Finally, DbDat is intended to be a framework to enable easy creation of new plugins and checks. Contributions from the security, or even database administrator, community is what will make this a great tool. The current set of checks are in no way complete, certainly more needs to be done. Please contribute!
Developing New Database Checks
Pull requests are very welcome! Checks are organized by database type (e.g. MySQL, Oracle, MS SQL, etc.) in the plugins folder. Each check is a single python file that must have
check_at the begining of the file name. Each file contains a class with a
do_checkmethod. This method is the primary logic for checks. The quick way to get started is to copy an existing check file and modify it. However, see the Developing Plugins section below for more details.
- Be sure you have the necessary dependencies installed for Python scripts to connect to your target database. See dependencies section below.
- Add a connection profile entry in the
etc/dbdat.conffile for each database you want to assess.
python dbdat.py -p <profile name>
- View the report. To view the report
cdto reports directory and run
python -m SimpleHTTPServer 9000(or choose a port number you prefer). Then open your browser and navigate to
python dbdat.py -h
The report organizes results by levels, which are RED, YELLOW, ORANGE, GRAY, and GREEN.
- RED - items needing immediate attention.
- YELLOW - items needing review.
- ORANGE - checks that failed to execute properly.
- GRAY - items that may not be applicable to the version of the database being assessed.
- GREEN - items that passed
So far DbDat has been tested on Debian Linux, CentOS Linux, and Windows 7 with Python 2.7
pip install MySQL-python
Or on Debian, run:
apt-get install python-mysqldb
pip install psycopg2
pip install cx_Oracle
MS SQL support
pip install pymssql
pip install ibm_dbor
Note: you will need to ensure the user running DbDat has access to execute DB2 CLP commands (e.g. db2 and db2level).
pip install mongodb
To support MongoDB YAML config files run:
pip install pyyaml
pip install couchdb