Auditing an Oracle database for security issues is very important. provides all of the information and tools that you will need Click here for details of Limited's detailed Oracle database security audit service Click here for details of Limited's Oracle Security Training Courses
There are 61 visitors online    
Cookie Policy:We only use essential cookies on small sections of this website. For details see here.

Pete Finnigan's Oracle security weblog

Home » Archives » October 2007 » The first Oracle 11g password cracker

[Previous entry: "Oracle Security on Windows presentation uploaded"] [Next entry: "Nice SQL Injection cheat sheet"]

The first Oracle 11g password cracker

October 2nd, 2007 by Pete

vonjeek from The hackers Choice has updated his Oracle password cracker to include the 11g password hashes and to use the 11g SHA1 password algorithm. The cracker also takes advantage of the fact that 11g keeps the old DES based/derived hash in the same place as the new SHA-1 hash. The THC 11g Password cracker is shown below in action for a sample password:

Oracle 11g Password Cracker

The password cracker exploits the fact that the old DES hash is stored. Therefore the upper case version of a password can be cracked first. If the password guessed generates a hash that matches that stored in the SYS.USER$.PASSWORD column then a further attack can be made on the SHA-1 hash to determine the case sensitive version of the password. This reduces the number of guesses necessary. As you can see the tool is graphically based and does a test based on user=pwd, dictionary attack then a brute force attack using the old DES based hash first. The readme is shown below:

Oracle 11g Password Cracker

explains how the cracker works. Nice tool!!

October 2007

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

Weblog Home
Weblog Archives

Oracle Security Tools page
Oracle security papers
Oracle Security alerts

Web Development
SQL Server Security

Atom 0.3 FEED
Powered by gm-rss 2.0.0

Valid XHTML 1.0!