1 of 1

Oracle APEX

Basics

Oracle APEX (Application Express) is a low-code development platform that enables users to build, design, and deploy scalable and secure web applications using a web browser. It is fully integrated with the Oracle Database, making it easy to create data-driven applications quickly. APEX is particularly popular for its ease of use and the ability to create sophisticated applications with minimal coding.

Oracle APEX is based on PL/SQL (Procedural Language/Structured Query Language), which is Oracle's procedural extension for SQL. The platform also uses other web technologies like HTML, CSS, and JavaScript for the user interface and client-side functionality.

As for security, Oracle APEX is generally considered secure as it has built-in security features to protect applications from common vulnerabilities, such as SQL injection and cross-site scripting (XSS). Oracle continuously updates and enhances the platform's security measures to keep up with new threats. However, the security of an APEX application also depends on the developers' practices, like proper input validation, access control implementation, and keeping the platform up-to-date with the latest security patches.

APEX URL Synthax

APEX URL that refers to Page 1 of Application 100 : http://localhost/apex/f?p=100:1:12432087235079

Interesting endpoints

Info Leak

Source code :

JS files :

META :

Testing Authorization and Authentification

Check the login process for weaknesses, such as :

Insecure transmission of login data,
Weak password requirements,
Susceptibility to brute force attacks (is there any account lockout ?),
Try to

Testing IDOR

Burp Intruder

https://my.app.com/apex/f?p=x:y:SESSION:::::ITEM:ITEM_VALUE

x = application ID y = page ID

Capture a request in the proxy and send it to the Intruder tool. Set your payload position on the pageID parameter
Under Payloads, choose the “Numbers” payload and set an appropriate range you’d like to test.
Run

Testing SQLi

sqlmap

See slide n°24 for more infos

Rewrite with wwv_flow.show :