Identifying Databases - Revision history

Sam: /* Extract Schema */

2021-06-28T12:49:23Z

Extract Schema

Sam: /* Initial Identification */

2021-06-28T12:48:13Z

Initial Identification

Sam at 12:46, 28 June 2021

2021-06-28T12:46:02Z

Sam at 12:31, 28 June 2021

2021-06-28T12:31:31Z

Sam: /* Initial Identification */

2021-06-28T10:19:09Z

Initial Identification

Sam at 10:16, 28 June 2021

2021-06-28T10:16:03Z

Sam: Created page with "This article describes how Truxton determines the type of a database file. =Initial Identification="

2021-06-27T07:22:28Z

Created page with "This article describes how Truxton determines the type of a database file. =Initial Identification="

New page

This article describes how Truxton determines the type of a database file.

=Initial Identification=

@@ Line 19: / Line 19: @@
 Once a database file has been identified, it will be sent to [[Expand|expansion]].
 There it will be opened and [https://en.wikipedia.org/wiki/Database_schema schema] extracted.
 ==Schema Scoring==

@@ Line 10: / Line 10: @@
 =Identification Process=
 ==Initial Identification==
-The first step in database identification is identifying the data file.
+The first step in database identification is recognizing the type of the data file.
 This is the traditional method of analyzing the content of the file to identify the program that created it.
 This uses whatever technique is necessary, [https://en.wikipedia.org/wiki/Magic_number_(programming) file signature] or recognizing data structures, to determine the type.

← Older revision		Revision as of 12:46, 28 June 2021
Line 55:		Line 55:
	This allows two different file types to have the same table name but scored differently.		This allows two different file types to have the same table name but scored differently.
	The format of the entry in the <code>[Name]</code> column of the <code>[DatabaseTableName]</code> table is "table.column"		The format of the entry in the <code>[Name]</code> column of the <code>[DatabaseTableName]</code> table is "table.column"
		+
		+	=Identification Walk Through=
		+	Let's say we are attempting to identify two different types of [[Type_SQLite_Database\|SQLite]] files:
		+	* Nuclear Launch Code Schedule
		+	* Bitcoin Wallet
		+
		+	They both consist of a single table, <code>[_Meta]</code> so we must dig a little deeper.
		+	The launch codes <code>[_Meta]</code> table has the following columns:
		+	<pre>
		+	[_id]
		+	[_date]
		+	[_code]
		+	</pre>
		+
		+	The wallet has the following columns:
		+	<pre>
		+	[_id]
		+	[_date]
		+	[_coin]
		+	</pre>
		+
		+	The <code>[DatabaseTableName]</code> table has the following entries in the <code>[Name]</code> column for launch codes:
		+	<pre>
		+	_Meta._id
		+	_Meta._date
		+	_Meta._code
		+	</pre>
		+
		+	The entries for the wallet are:
		+	<pre>
		+	_Meta._id
		+	_Meta._date
		+	_Meta._coin
		+	</pre>
		+
		+	When Truxton begins scoring this, each file type will have a score of two because they share the <code>[_id]</code> and <code>[_date]</code> columns.
		+	When Truxton encounters the <code>[_code]</code> column, it will match the launch codes file type raising its score to three.
		+	Once all tables and columns in the schema have been scored, the file type with most matches is chosen as the true file type.

@@ Line 6: / Line 6: @@
 In order to know how to exploit a database file you must first exploit the database file.
-=Initial Identification=
+This identification is database driven so you can [[Truxton C API#Database Identification|add your own types]] if you wish.
 The first step in database identification is identifying the data file.
 This is the traditional method of analyzing the content of the file to identify the program that created it.
@@ Line 13: / Line 16: @@
 This is good enough to tell you that a bag of bytes is a [[Type_SQLite_Database|SQLite]] file but it won't tell you that it is a [[Type_GMail_Mailstore_Database|GMail mailstore]].
-=Extract Schema=
+==Extract Schema==
-The [https://en.wikipedia.org/wiki/Database_schema schema]
+Once a database file has been identified, it will be sent to [[Expand|expansion]].

@@ Line 10: / Line 10: @@
 This is the traditional method of analyzing the content of the file to identify the program that created it.
 This uses whatever technique is necessary, [https://en.wikipedia.org/wiki/Magic_number_(programming) file signature] or recognizing data structures, to determine the type.
 =Extract Schema=
 The [https://en.wikipedia.org/wiki/Database_schema schema]

← Older revision		Revision as of 10:16, 28 June 2021
Line 1:		Line 1:
	This article describes how Truxton determines the type of a database file.		This article describes how Truxton determines the type of a database file.
		+
		+	=Introduction=
		+	Databases present a unique problem for Truxton.
		+	While it is easy to determine the basic type of the file, [[Type_SQLite_Database\|SQLite]] or [[Type_Microsoft_ESE\|ESE]], determining the type of database for exploitation purposes is problematic.
		+	In order to know how to exploit a database file you must first exploit the database file.

	=Initial Identification=		=Initial Identification=
		+	The first step in database identification is identifying the data file.
		+	This is the traditional method of analyzing the content of the file to identify the program that created it.
		+	This uses whatever technique is necessary, [https://en.wikipedia.org/wiki/Magic_number_(programming) file signature] or recognizing data structures, to determine the type.
		+
		+	=Extract Schema=
		+	The [https://en.wikipedia.org/wiki/Database_schema schema]