Vulnerability assessment (VA) policies : Penetration tests : Connection options for penetration tests
Connection options for penetration tests
For penetration tests, FortiDB uses one of the following options to connect to target databases:
Login — The login connection method is available for all target database types.
Hash-based — A 'hash' is the value that is the result of encrypting a clear-text string. The hash-based method is a safer, offline approach, but it is available for Oracle and Microsoft SQL target databases only. If you use the hash-based method for Sybase or DB2 targets, FortiDB cannot apply any of the pentest polices, the assessment result is essentially empty, and no error is reported.
Hybrid — FortiDB uses the hash-based method if it is available (that is, when the database is Oracle or Microsoft SQL). Otherwise, it uses the login method.
If the penetration test login attempts are unsuccessful, the database may prevent any users, including valid users, from logging in.
See also
Configuring and running penetration test assessments