[PEN-TEST] Oracle USER$ password hashes (Summary)

[Olle Segerdahl <olle () NXS SE>]

Ok, what I can understand from the answers in this thread:

The password and username are case insensitive by default (double quote exeption exists)

Both password and username can be 1 to 30 characters long

The password hash is a 8 byte string in hex notation (ie. 8 bytes large)

The password hash is salted with the uppercased username


So, anybody have any idea of what algorithms might be used to generate 8 bytes output from two 1-30 byte strings?

/olle