Must connect the long-distance Oracle database, needs to know SID, user, the password, certainly also has the most important IP address. If SID is revised by the manager, may carry on using sidguess explains, speed unusual quick, as for the success or not, must think that your dictionary disposed. Explains the effect like chart 1.
Figure 1
The Oracle different edition has the massive default account password. But in some situations, the Oracle database administrator for revised the default password, we must choose the violence to explain. If the account explains successfully, registers, is DBA jurisdiction is best, not, may also carry on using Oracle some cracks proposes the power to DBA. After entering the database, what I choose generally is captures other users the password Hasche value, then local Rainbow explains. If the same webpage also has other Oracle database, may grasp the package to wait for that other users Oracle registers the confirmation, takes out the sensitive information, then explains. Further expanded victory. Below I separately speak these three kinds to explain the method and the related tool's use.
Quotation
Related Oracle password elementary knowledge
1st, the standard Oracle password may by English letter, the digit, #, get down draws a line (_), US dollar character ($) constitutes, the password greatest length is 30 characters; The Oracle password cannot by " $ ", “#”,” _ “or any digital opening; The password packet of energy does not contain the elephant " SELECT ", “DELETE”, “CREATE " this kind of Oracle/SQL key words.
2nd, Oracle weak algorithm encryption mechanism: Two same user names and the password in two different Oracle database machine, will have the same Hasche value. These Hasche value saves in the SYS.USER$ table. May through look like DBA_USERS this kind of view to visit.
3rd, under Oracle default disposition, each account, if has 10 time defeat to register, this account will be locked. But the SYS account has the highest jurisdiction in the Oracle database, can handle anything,/closes the Oracle database including the start. Even if SYS is locked, also can still visit the database.
First, the long-distance violence explains
By the front elementary knowledge 3, may know that the choice long-distance explains Oracle the best account is SYS, because the account forever is for this reason effective. In Oracle10g
Beforehand edition in installment time has not prompted revises SYS the default password, Oracle10g, although prompt revision password, but has not inspected the password the complexity. Like Figure 2
Figure 2
May use the Orabrute tool to carry on long-distance explains, in uses this tool's time, needs the system to install good Sqlplus ahead of time, this tool's principle is very simple, does not stop transfer Sqlplus then carries on registers the confirmation, what account choice is SYS, the password for password.txt's in password word. So long as registers successfully, will transfer the selectpassword.sql script to capture in the SYS.USER$ table other user's Hasche value, then withdrawal procedure. Here has the attention place, when second time moves Orabrute time, the thepasswordsarehere .txt which with the table of contents under and output.txt document needs to delete or the migration preceding time moves when Orabrute produces.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> encryption decipher
> Content
Category: Home
> encryption decipher
