question on userlikepwd

[marcelosoyyo]

hi, i've been testing the tool, and as i dont know phyton i cant get much into the code. My question is how does the tool manage to discover valid username/passwords that are not listed in the *.txt files when i execute the tool with a user that only has create session privilege? i found it not only discover the predefined users, but if i create any user with the same password as username it detects it!

[omair2084]

userlikepwd works by executing the query "select username from ALL_USERS". And it checks all users who have the same password as username.

http://www.dadbm.com/oracle-create-session-privilege/

[quentinhardy]

Yep. See https://github.com/quentinhardy/odat/blob/master/UsernameLikePassword.py