search

quentinhardy / odat

ODAT: Oracle Database Attacking Tool
1.62k stars 344 forks source link

trouble with sidguesser #17

Closed marcelosoyyo closed 6 years ago

marcelosoyyo commented 6 years ago

Hi, i've testing the standalone version in Oracle Linux 6 64bit, with oracle 12c, 1 cdb called cdb1 with 2 pdbs, pdb1_1 and pdb2_1

if i try: ./odat-libc2.5-x8664 sidguesser -s ol6 -p 1521 --sids-min-size 6 --sids-max-size 6 --sid-charset bdp12

it only detects sids cdb1 (as i have already added it to sids.txt) and pdb1_2 but not pdb1_1 if i try: ./odat-libc2.5-x8664 sidguesser -s ol6 -p 1521 --sids-min-size 6 --sids-max-size 6 --sid-charset bdp112 it detects cdb1 (as i have already added it to sids.txt) and both pdb1_1 & pdb1_2

so it seems its not trying to repeat characters from the charset.

omair2084 commented 6 years ago

Good catch, this tool is using permutations for aSID in permutations(list(charset), size): This should be replaced by product as seen in itertools example

product('ABCD', repeat=2)
AA AB AC AD BA BB BC BD CA CB CC CD DA DB DC DD
permutations('ABCD', 2)
AB AC AD BA BC BD CA CB CD DA DB DC
quentinhardy commented 6 years ago

Thank you for this bug fix. Best regards.