oracle auth sniffing

ghost

0 0

17 years ago

I have an application which connects to a oracle database server. I know the user name but I need a password. I've user Ethereal and sniffed something. I have a program to crack oracle hashes, but I don't know how to get the hash.

Thanks for help

Uber0n

Member

0 0

17 years ago

What have you found then?

ghost

0 0

17 years ago

……AUTH_SESSKEY.@@902 0BCFB66E 26E30558 8B1DE971 BCBB139A EC7DCAD1 366FBACF 77C16816 BC369….AUTH_VFR_DATA.. .9………….. ……………. .

ghost

0 0

17 years ago

Found lots of stuff. Check this out: http://www.freelists.org/archives/dbsec/11-2006/msg00005.html

There's a code in there which decrypts your stuff.

Have fun

Cheers

ghost

0 0

17 years ago

The problem is that I have to know the password hash. And I don't know it.

ghost

0 0

17 years ago

http://www.sans.org/reading_room/special/index.php?id=oracle_pass

is supposed to be a full paper/how-to. Give it a try.