[TOOL] Hashattack - Auditing Privilged Oracle Passwords

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Hashattack - Auditing Privilged Oracle Passwords
------------------------------------------------------------------------


SUMMARY



DETAILS

Hashattack is a tool that can be used to build a table of Oracle password 
hashes from a dictionary file for a designated username.
Hashes are calculated by creating a user account similar to the target 
account to be audited and repeatedly changing the password with "ALTER 
USER" for each dictionary word, storing the hash for each password in a 
table.

Once the table of hashes is built, a simple SELECT can be issued to 
determine if the password hash for a target user is a simple dictionary 
word:
SQL> select h.username, h.password, h.hash
  2  from hashattack h, dba_users d
  3  where d.password = h.hash and h.username = 'SYS';

USERNAME   PASSWORD             HASH
---------- -------------------- --------------------
SYS        KILTPLEAT            2BBDC477FFB28563

SQL>

Download Information:
The tool is written in PL/SQL, and can be downloaded from the project's 
homepage at:  <http://802.11ninja.net/code/hashattack-0.1.tgz> 
http://802.11ninja.net/code/hashattack-0.1.tgz


ADDITIONAL INFORMATION

The information has been provided by  <mailto:jwright@xxxxxxxxxxx> Joshua 
Wright.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.