Pete Finnigan's Oracle Security Weblog

I was emailed the other day by Dave to tell me that I had incorrectly named the http://www.trantechnologies.com/pass_cracker.zip - (broken link) Russian password cracker for Oracle written by Tran Technologies. I said it was written by Bead Dang but in fact it was written by Bear Dang. Sorry to the authors for this mistake. I have updated my Oracle Security Tools page to correct this error.

This is a useful tool for auditing passwords in an Oracle database. It is a PL/SQL program and source code is included. It does a brute force check to find passwords that users have specified. There is a downside in that it should really be used in a separate database to prevent resource hogging issues in the database where the users passwords are to be checked. Because its PL/SQL based and uses ALTER USER commands its quite slow but still useful.

Also remember to check for default Oracle users with default passwords still set as well as auditing users passwords.