External & Perimeter Testing
We probe internet-exposed self-service portals, middleware consoles, and report repositories to establish what an unauthenticated attacker can reach and exploit before any credentials exist.
Decades on the Offense
Led by an offensive-security team whose founder holds CISSP, OSCP, and OSCE, with two decades breaking into enterprise systems at IBM X-Force Red, Trustwave SpiderLabs, and IntegSec.
Real Human Pentesters
Not a scanner reselling a dashboard. Experienced operators manually chain misconfigurations into proven attack paths a tool will never produce.
Per-Product Depth
EBS responsibilities, PeopleTools security, JDE Security Workbench, WebLogic and Tuxedo internals, and the Oracle DBA layer. Testing planned per product, not per template.
Why Oracle ERP Needs Its Own Methodology
"Oracle ERP" is not one product. It is four unrelated codebases Oracle built or acquired at different times, each with a different security model and a different signature attack. A tester who treats them as variations on a theme will miss the real path on three of them. Oracle ERP flaws also appear in actively used in real attacks.
✓
The Security Model Is the Product
In Oracle ERP, a vulnerability is usually a responsibility, permission list, or duty role granted too widely, not a memory-safety bug. Testing has to model real business roles. Scanners cannot see any of it.
✓
Middleware Nobody Owns
WebLogic, WebSphere, and Oracle HTTP Server sit under every one of these products, usually orphaned between the DBA team and infrastructure. An exposed /console or an unpatched T3 listener is a complete bypass. An ERP test that skips the app server is not an ERP test.
✓
Reporting Engines Execute Code by Design
Concurrent Manager, Process Scheduler, UBE, and BI Publisher run code and arbitrary SQL as intended behavior. They are features, not bugs, and they are where most authenticated privilege escalation actually happens.
✓
JD Edwards Denies by Exception
In EBS, PeopleSoft, and SAP a user has no access until something grants it. In JDE a user has access unless a record explicitly denies it. The absence of a security record is a grant, so "nothing flagged in Security Workbench" means the opposite of what it means everywhere else.
✓
The Exploit Is a Business Transaction
The realistic worst case is not root on the app server. It is a payment to an attacker-controlled bank account, through entirely legitimate screens, by a user with one responsibility too many. A test that stops at platform compromise never sees it.
✓
These Systems Are Old and Fragile
Aggressive testing against a production Concurrent Manager or Tuxedo domain can halt period close. Safety controls, rate limiting, and coordinated test windows are part of the method, not optional courtesy.
Every Product Has a Signature Attack
These are the paths that separate a real Oracle ERP test from a network scan with an Oracle logo on the cover. Each is specific to one product, and each is routinely present.
E-Business Suite: Diagnostics to Arbitrary SQL
With Utilities: Diagnostics set to Yes, a user can open Help, then Diagnostics, then Examine, and run arbitrary SQL as APPS. We check the value at site, application, responsibility, and user level. Site-level Yes on production is critical, and it is the finding most often present.
E-Business Suite: The .dbc Credential Path
The .dbc file holds the JDBC URL, the guest credentials, and the application server ID. Possession lets an attacker authenticate as the application server, and combined with app server ID authentication turned off it is a full bypass. We also test reversible password recovery from FND_USER and the classic APPLSYSPUB unauthenticated-to-credentials pivot.
PeopleSoft: Token Forgery and Cross-Node Replay
A weak or default node password lets an attacker mint a valid authentication token for any user, including PS, with no credentials at all. We also test replay across nodes: a token obtained from a development or campus environment, presented to production, is accepted by any node listed as trusted.
PeopleSoft: Connect ID to Total Database Ownership
Connect ID credentials sit in a config file on the app tier. That account can read the table holding the reversibly-encrypted Access ID password, which is SYSADM. This is the canonical path from a foothold to full ownership of the database, and it is aggravated wherever the default encryption key is still in use.
JD Edwards: Server Manager and Orchestrator
Server Manager is the management plane for the whole estate, its console can reveal credentials for every managed component, and its default administrative credentials are widely known and widely unchanged. Separately, Groovy scripting inside Orchestrator gives arbitrary code execution on the AIS server, the highest-value authenticated finding in a JDE estate.
Fusion Cloud: The BI Publisher Data Bypass
A user who can author a BI Publisher data model can write arbitrary SQL against the Fusion schema and return rows their role cannot see in the UI. It is a complete data-security bypass and the single most important test in a Fusion review. We pair it with role analysis on Application Implementation Consultant and IT Security Manager in production.
WHY CHOOSE US
Why Teams Choose IntegSec for Oracle
-1.png?width=48&height=48&name=Featured%20icon%20(12)-1.png){kind=small}
Planned Per Product
EBS, PeopleSoft, JD Edwards, and Fusion each get their own test plan, because each has a different security model and a different signature attack. One template applied to four products produces one useful report and three thin ones.
.png?width=48&height=48&name=Featured%20icon%20(9).png){kind=small}
Tested at Three Levels
Every capability is tested at the screen, the underlying table, and the API or web service equivalent. Controls in Oracle ERP are frequently enforced only at the screen, and that gap is where the material findings live.
-2.png?width=48&height=48&name=Featured%20icon%20(6)-2.png){kind=small}
Two Questions, Not One
Is the control enforced, and is the control sufficient? The first is a technical failure. The second is a design failure, it carries most of the material findings, and a purely technical tester will never raise it.
-2.png?width=48&height=48&name=Featured%20icon%20(2)-2.png){kind=small}
Non-Disruptive by Design
We scope carefully, avoid period close and payroll windows, rate-limit against fragile listeners, and coordinate with your DBA and middleware teams so testing never becomes an outage.
Oracle ERP Penetration Testing FAQ
Common questions from security, DBA, and audit teams evaluating an Oracle ERP penetration test.
-
Offensive security testing focused on the Oracle-specific attack surface: the unauthenticated EBS web tier, PeopleSoft's Tuxedo and Jolt listeners, JD Edwards' JDENET and Server Manager, the WebLogic and WebSphere middleware underneath all of them, the batch and reporting engines that execute code by design, and the database that bypasses every application control.
-
No, and that is the whole point. They are four unrelated codebases sharing a vendor and a patch calendar. Each has a different signature attack: privileged SQL through Diagnostics in EBS, token forgery in PeopleSoft, and a deny-by-exception model in JDE where the absence of a rule is a grant. We plan per product.
-
Not in the same sense, and we won't claim otherwise. Fusion is Oracle-managed SaaS, so the infrastructure and application code are not yours to test. What we deliver is a rigorous security and configuration review covering role and data security, the BI Publisher bypass, integration paths, and privileged access. Calling that a penetration test would misrepresent the assurance you receive.
-
OPatching fixes known flaws in Oracle's code. It does not fix responsibilities granted too widely, reporting engines that run arbitrary SQL by design, config files holding reversible database credentials, or the orphaned WebLogic instance nobody owns. Most material findings are configuration and authorization design. Patching also cannot tell you whether you were already compromised beforehand.
-
Yes. We rate-limit against fragile listeners, never fuzz production Tuxedo or Concurrent Manager, avoid period close and payroll windows, and run business-process scenarios against agreed test master data with written stop lines. Where a scenario cannot be stopped safely, we demonstrate it in non-production or document it with the evidence chain instead of executing it.
-
Book a 30-minute scoping call. We identify which products and environments are in scope, agree the rules of engagement, and define the right test. We also test SAP, Microsoft Dynamics, and Salesforce.
Explore More Security Solutions
IntegSec provides specialized offensive security testing across the platforms and industries that run your business.
SAP & ERP Security
Penetration testing for S/4HANA, NetWeaver, RFC, Fiori, and HANA environments.
-3.png?width=70&height=70&name=Group%202085662916%20(1)-3.png)
Microsoft Dynamics Security
Testing for D365 Finance & Operations, Business Central, legacy AX/NAV/GP, and Power Platform.
-3.png?width=70&height=70&name=Group%202085662916%20(2)-3.png)
Salesforce Security
Penetration testing and security reviews for Salesforce orgs, Apex, and Experience Cloud.
-3.png?width=70&height=70&name=Group%202085662916%20(3)-3.png)
Financial Services
PCI DSS compliance and security testing for banks and financial institutions.