Re: [PEN-TEST] Oracle USER$ password hashes

[Nicolas Gregoire <nicolas.gregoire () 7THZONE COM>]

Olle Segerdahl a écrit :
> ...
> Since the hashes are always the same for the same password, it most
> definately isn't salted....
> ...
> change_on_install       = D4C5016086B2DC6A
> manager                 = D4DF7931AB130E37

Are the first 2 characters always "D4" ?

It could the fixed salt, ie. $crypted  = unkown-crypt("D4", $clear);