{"id":2108,"date":"2011-01-16T23:00:00","date_gmt":"2011-01-16T22:00:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/"},"modified":"2011-01-16T23:00:00","modified_gmt":"2011-01-16T22:00:00","slug":"pass-words-oracle-vos-mots-de-passe-sont-ils-sris","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/","title":{"rendered":"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?"},"content":{"rendered":"<p>Quelles sont les faiblesses de l&#8217;encryption des mots de passe Oracle ? Comment est-ce qu&#8217;Oracle cr\u00e9e les cl\u00e9s de hachage afin d&#8217;en am\u00e9liorer la s\u00e9curit\u00e9 ? C&#8217;est ce que je vous propose de d\u00e9couvrir dans ce post.<\/p>\n<p>Le mot de passe est la forme la plus commune d&#8217;authentification. Ce dernier est stock\u00e9 dans une table Oracle sous la forme d&#8217;une cl\u00e9 de hachage. Lorsqu&#8217;un utilisateur tente de se connecter, le mot de passe saisi est alors crypt\u00e9 (avec le m\u00eame algorithme de cryptage) puis compar\u00e9 \u00e0 celle stock\u00e9 dans la base pour identification.<\/p>\n<p align=\"justify\">Beaucoup d&#8217;administrateurs de bases de donn\u00e9es connaissent la vue DBA_USERS qui contient les informations d&#8217;utilisateur (Nom, mot de passe, verrouillage du compte etc.). Mais depuis la version 11g, le champ password n&#8217;est plus renseign\u00e9. Il est cependant toujours possible de l&#8217;obtenir gr\u00e2ce \u00e0 la table SYS.USER$. De plus, ce dernier a \u00e9t\u00e9 rendu &#8220;case sensitive&#8221;. Un prochain posting sera publi\u00e9 tout sp\u00e9cialement \u00e0 ce sujet. Apparemment, Oracle pr\u00e9voit de renforcer la s\u00e9curit\u00e9 des mots de passe et de rendre moins visible les cl\u00e9s.<\/p>\n<p align=\"justify\">Comment peut-on consid\u00e9rer un mot de passe comme s\u00e9curis\u00e9 ? Cela d\u00e9pend des \u00e9l\u00e9ments suivants :<\/p>\n<ul>\n<li>\n<div dir=\"ltr\" align=\"justify\">La cha\u00eene al\u00e9atoire ajout\u00e9 \u00e0 la cl\u00e9 (= salt)<\/div>\n<\/li>\n<li>\n<div align=\"justify\">Le nombre d&#8217;it\u00e9rations de l&#8217;encryption<\/div>\n<\/li>\n<li>\n<div align=\"justify\">La longueur de la cl\u00e9<\/div>\n<\/li>\n<\/ul>\n<h3>1. La cha\u00eene al\u00e9atoire ajout\u00e9 (= Salt)<\/h3>\n<p>Voici un petit descriptif des termes employ\u00e9s dans cet article :<\/p>\n<ul>\n<li>Cl\u00e9 : d\u00e9signe la cha\u00eene transform\u00e9e qui sera crypt\u00e9e par la cl\u00e9 de cryptage<\/li>\n<li>Cl\u00e9 de cryptage : la cha\u00eene qui sera utilis\u00e9e pour crypter<\/li>\n<li>Cl\u00e9 de hachage : la cha\u00eene de r\u00e9sultat apr\u00e8s cryptage<\/li>\n<\/ul>\n<p>Il est \u00e9vident qu&#8217;Oracle utilise la combinaison de la cha\u00eene de connexion et du mot de passe pour cr\u00e9er sa cl\u00e9 de hachage. Si on prend l&#8217;exemple de la concat\u00e9nation sys et manager, celle-ci donne toujours la cl\u00e9 de hachage\u00a0suivante 5638228DAF52805F quel que soit le serveur, le syst\u00e8me d&#8217;exploitation ou la version d&#8217;Oracle. C&#8217;est un moyen facile de d\u00e9tecter si les mots de passe par d\u00e9fauts sont toujours utilis\u00e9s ou si un mot de passe par d\u00e9faut a \u00e9t\u00e9 d\u00e9fini. Pour trouver un mot de passe, il suffit donc de g\u00e9n\u00e9rer les cl\u00e9s de hachage pour un utilisateur donn\u00e9 avec toutes les combinaisons possibles de mots de passe, puis de les comparer \u00e0 la table des mots de passe. Si les cl\u00e9s de hachage correspondent, vous avez obtenu son mot de passe. De plus, en cr\u00e9ant un utilisateur \u00ab\u00a0sy\u00a0\u00bb et un mot de passe \u00ab\u00a0smanager\u00a0\u00bb, la cl\u00e9 de hachage obtenue est identique \u00e0 la cl\u00e9 de hachage\u00a0g\u00e9n\u00e9r\u00e9e par sys et manager, comme d\u00e9montr\u00e9 ci-dessous :<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">SQL&gt; create user sy identified by smanager;Utilisateur cr\u00e9e.SQL&gt; select password from user$ where name='SY';PASSWORD\n------------------------------\n5638228DAF52805F<\/pre>\n<p>&nbsp;<\/p>\n<p>Cet exemple d\u00e9montre qu&#8217;il y a bien concat\u00e9nation de l&#8217;utilisateur et du mot de passe.<br \/>\nCe m\u00e9canisme est aussi vrai pour les minuscules et majuscules. Donc, toutes les variantes suivantes donneront cette m\u00eame cl\u00e9 :<\/p>\n<ul>\n<li>SyS MaNaGer<\/li>\n<li>SYS MANAGER<\/li>\n<li>Sys Manager<\/li>\n<li>SYS manager<\/li>\n<li>sys MANAGER<\/li>\n<li>&#8230;<\/li>\n<\/ul>\n<p>La cl\u00e9 se compose de cette mani\u00e8re ou du moins contient ces \u00e9l\u00e9ments :<\/p>\n<table style=\"width: 100%;\" border=\"1\" cellspacing=\"0\" cellpadding=\"4\">\n<colgroup>\n<col width=\"256\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<td valign=\"top\" width=\"100%\">upper(user||password)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Cependant, ce n&#8217;est pas le seul crit\u00e8re n\u00e9cessaire pour g\u00e9n\u00e9rer une cl\u00e9 de hachage valide. En effet, si l&#8217;on tente de g\u00e9n\u00e9rer une clef de hachage \u00e0 l&#8217;aide de cette seule r\u00e8gle, les erreurs suivantes nous serons retourn\u00e9es par Oracle.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">ORA-28232: longueur d'entr\u00e9e non valide pour le toolkit Obfuscation\nORA-06512: \u00e0 \"SYS.DBMS_OBFUSCATION_TOOLKIT_FFI\", ligne 21\nORA-06512: \u00e0 \"SYS.DBMS_OBFUSCATION_TOOLKIT\", ligne 99\nORA-06512: \u00e0 ligne 25\n28232. 0000 -\u00a0 \"invalid input length for obfuscation toolkit\"\n*Cause:\u00a0\u00a0\u00a0 Length of data submitted for encryption or decryption is not a\nmultiple of 8 bytes.\n*Action:\u00a0\u00a0 Make sure that the length of the data to be encrypted or decrypted\nis a multiple of 8 bytes.<\/pre>\n<p>La cl\u00e9 doit \u00eatre compos\u00e9e d&#8217;un multiple de 8 bytes pour que le package dbms_obfuscation_toolkit fonctionne. Apparemment, la cl\u00e9 est compl\u00e9t\u00e9e de vide, ce qui donnerait au final ceci :<\/p>\n<table style=\"width: 100%;\" border=\"1\" cellspacing=\"0\" cellpadding=\"4\">\n<colgroup>\n<col width=\"256\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<td valign=\"top\" width=\"100%\">SYSMANAGER (en tout 16 caract\u00e8res)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Voici le r\u00e9sultat (en utilisant le package <em>dbms_obfuscation_toolkit.DESEncrypt<\/em> qui est d\u00e9velopp\u00e9 dans le prochain chapitre) :<i><br \/>\n<\/i><\/p>\n<table style=\"width: 100%;\" border=\"1\" cellspacing=\"0\" cellpadding=\"4\">\n<colgroup>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col width=\"16\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr valign=\"top\">\n<td width=\"6%\">1<\/td>\n<td width=\"6%\">2<\/td>\n<td width=\"6%\">3<\/td>\n<td width=\"6%\">4<\/td>\n<td width=\"6%\">5<\/td>\n<td width=\"6%\">6<\/td>\n<td width=\"6%\">7<\/td>\n<td width=\"6%\">8<\/td>\n<td width=\"6%\">9<\/td>\n<td width=\"6%\">10<\/td>\n<td width=\"6%\">11<\/td>\n<td width=\"6%\">12<\/td>\n<td width=\"6%\">13<\/td>\n<td width=\"6%\">14<\/td>\n<td width=\"6%\">15<\/td>\n<td width=\"6%\">16<\/td>\n<\/tr>\n<tr valign=\"top\">\n<td width=\"6%\">S<\/td>\n<td width=\"6%\">Y<\/td>\n<td width=\"6%\">S<\/td>\n<td width=\"6%\">M<\/td>\n<td width=\"6%\">A<\/td>\n<td width=\"6%\">N<\/td>\n<td width=\"6%\">A<\/td>\n<td width=\"6%\">G<\/td>\n<td width=\"6%\">E<\/td>\n<td width=\"6%\">R<\/td>\n<td width=\"6%\">&#8216; &#8216;<\/td>\n<td width=\"6%\">&#8216; &#8216;<\/td>\n<td width=\"6%\">&#8216; &#8216;<\/td>\n<td width=\"6%\">&#8216; &#8216;<\/td>\n<td width=\"6%\">&#8216; &#8216;<\/td>\n<td width=\"6%\">&#8216; &#8216;<\/td>\n<\/tr>\n<tr valign=\"top\">\n<td width=\"6%\">E<\/td>\n<td width=\"6%\">F<\/td>\n<td width=\"6%\">1<\/td>\n<td width=\"6%\">3<\/td>\n<td width=\"6%\">E<\/td>\n<td width=\"6%\">4<\/td>\n<td width=\"6%\">9<\/td>\n<td width=\"6%\">C<\/td>\n<td width=\"6%\">8<\/td>\n<td width=\"6%\">1<\/td>\n<td width=\"6%\">6<\/td>\n<td width=\"6%\">1<\/td>\n<td width=\"6%\">D<\/td>\n<td width=\"6%\">0<\/td>\n<td width=\"6%\">2<\/td>\n<td width=\"6%\">F<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Ce qui ne correspond pas \u00e0 la cl\u00e9 de hachage 5638228DAF52805F qui est stock\u00e9 dans la table USER$ (par contre, elle est bien compos\u00e9e de 16 positions). Il y a bien un m\u00e9canisme manquant pour obtenir la cl\u00e9. La solution m&#8217;a \u00e9t\u00e9 donn\u00e9e par Pete Flannigan <a href=\"http:\/\/www.petefinnigan.com\/\">http:\/\/www.petefinnigan.com<\/a>.<\/p>\n<p>En r\u00e9alit\u00e9, il ne s&#8217;agit pas de &#8221; &#8221; (= vide) mais du caract\u00e8re CHR(0). Si les deux retournent bel et bien un blanc visuellement. Le code ascii n&#8217;est pas identique, car l&#8217;un retourne NULL et l&#8217;autre 0 comme le montre le tableau ci-dessous :<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">SQL&gt; select '' \"blanc\",ascii(''),chr(0) \"chr(0)\",ascii(chr(0)) from dual;\n\nblanc\u00a0\u00a0\u00a0 ASCII('')\u00a0 chr(0)\u00a0 ASCII(CHR(0))\n------\u00a0 ---------- -------\u00a0 -------------\n0<\/pre>\n<p>De plus, la cl\u00e9 est \u00e9galement compos\u00e9e du caract\u00e8re chr(0) entre chaque lettre qui compose l&#8217;utilisateur et son mot de passe. Voici le r\u00e9sultat final :<\/p>\n<table style=\"width: 100%;\" border=\"1\" cellspacing=\"0\" cellpadding=\"4\">\n<colgroup>\n<col width=\"256\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<td valign=\"top\" width=\"100%\">&#8216;S&#8217;||chr(0)||&#8217;Y&#8217;||chr(0)||&#8217;S&#8217;||chr(0)||&#8217;M&#8217;||chr(0)||&#8217;A&#8217;||chr(0)||&#8217;N&#8217;||chr(0)||&#8217;A&#8217;||chr(0)||&#8217;G&#8217;||chr(0)||&#8217;E&#8217;||chr(0)||&#8217;R&#8217;||chr(0)||chr(0)||chr(0)||chr(0)||chr(0) (<!-- La je suis perdu. La cl\u00e9 \u00e9tait compos\u00e9e de 16 caract\u00e8res maintenant il y en a 24 ? -->en tout 24 caract\u00e8res)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Maintenant, la cl\u00e9 se compose de 24 bytes, parce qu&#8217;il faut toujours obtenir une cha\u00eene qui est un multiple de 8. Il y a 10 bytes (pour la chaine utilisateur et mot de passe), plus 9 bytes pour les Chr(0) qui s\u00e9parent chaque lettre de la cha\u00ecne. Ce qui donne un total de 19 bytes. Il manque donc 5 bytes pour compl\u00e9ter la cl\u00e9.<br \/>\nVoici un script qui permet la construction de cette cha\u00eene en fournissant la concat\u00e9nation du nom de l&#8217;utilisateur et son mot de passe :<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"><samp><\/samp>-- Source de Pete Flannigan\n\nDeclare\nvString varchar2(32):=upper('SYSMANAGER');\nvLett char(1);\nvLeng number;\nvCompo varchar2(32);\nvModul number;\nvRest number;\n\nBegin\nvLeng:=length(vString);\nfor i in 1..vleng\nloop\nvlett:=substr(vString,i,1);\nvCompo:=vCompo||chr(0)||vLett;\nend loop;\nvModul:= mod((vLeng*2),8);\nif (vModul = 0) then\nvRest:= 0;\nelse vRest:=8 - vModul;\nend if;\nfor i in 1..vRest\nloop\nvCompo:=vCompo||chr(0);\nend loop;\ndbms_output.put_line(vCompo);\nend;\n\/<\/pre>\n<h3>2. Le nombre d&#8217;it\u00e9rations de l&#8217;encryption<\/h3>\n<p>Oracle utilise le package <em>dbms_obfuscation_toolkit.DESEncrypt<\/em> pour crypter le mot de passe.<br \/>\nLe package n\u00e9cessite <!-- Le username et password ? -->2 param\u00e8tres d&#8217;entr\u00e9es en raw et ce dernier retourne une valeur en raw qui est la cl\u00e9 de hachage. Le premier param\u00e8tre est la chaine \u00e0 crypter (la cl\u00e9, celle qui a \u00e9t\u00e9 construite dans le chapitre pr\u00e9c\u00e9dent). Le deuxi\u00e8me est la cl\u00e9 de cryptage qui est une suite de 16 charact\u00e8res de 0 \u00e0 F, voici la cha\u00eene:<\/p>\n<table style=\"width: 100%;\" border=\"1\" cellspacing=\"0\" cellpadding=\"4\">\n<colgroup>\n<col width=\"256\" \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/>\n<col \/><\/colgroup>\n<tbody>\n<tr>\n<td valign=\"top\" width=\"100%\">&#8216;0123456789ABCDEF&#8217;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Ce qui donnerait comme fonction de cryptage ceci :<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">-- Source de Pete FlanniganvString varchar2(32):='SYSMANAGER';\nvLett char(1);\nvLeng number;\nvCompo varchar2(32);\nvModul number;\nvRest number;\nvPwd raw(128);\nvKeyRaw1 raw(128):=hextoraw('0123456789ABCDEF');\nvKeyRaw2 raw(128);\nvPwdHash raw(2048);\nvHexstr varchar2(2048);\nvPwdHashStr varchar2(2048);\n\nBegin\nvLeng:=length(vString);\nfor i in 1..vleng\nloop\nvlett:=substr(vString,i,1);\nvCompo:=vCompo||chr(0)||vLett;\nend loop;\nvModul:= mod((vLeng*2),8);\nif (vModul = 0) then\nvRest:= 0;\nelse vRest:=8 - vModul;\nend if;\nfor i in 1..vRest\nloop\nvCompo:=vCompo||chr(0);\nend loop;\nvPwd:=utl_raw.cast_to_raw(vCompo);\n\ndbms_obfuscation_toolkit.DESEncrypt(input =&gt;vPwd,key=&gt;vKeyRaw1,encrypted_data =&gt;vPwdHash);\nvHexstr:=rawtohex(vPwdHash);\nvLeng:=length(vHexstr);\nvPwdHashStr:=substr(vHexstr,(vLeng-16+1),16);\ndbms_output.put_line('Voici la cl\u00e9: '||vPwdHashStr);\nend;\n\/\nVoici la cl\u00e9: 48F34A5A3E8C2ED8 \nProc\u00e9dure PL\/SQL termin\u00e9e avec succ\u00e8s.<\/pre>\n<p>&nbsp;<br \/>\nCe n&#8217;est pas vraiment le r\u00e9sultat attendu !<br \/>\nSimplement, parce que toute cl\u00e9 efficace est crypt\u00e9e plusieurs fois, sinon, elle n&#8217;est pas efficace. Cependant, un nombre trop important d&#8217;it\u00e9rations de cryptage serait fatal pour le temps de login qui serait largement ralong\u00e9 (pour d\u00e9cryptrer la cl\u00e9, justement). Oracle a choisi le cryptage \u00e0 deux niveaux. Cette fois-ci, la cl\u00e9 de cryptage utilis\u00e9e est\u00a0la cl\u00e9 de hachage\u00a0obtenue apr\u00e8s le premier cryptage que nous venons d&#8217;obtenir :<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">-- Source de Pete FlanniganvString varchar2(32):='SYSMANAGER';\nvLett char(1);\nvLeng number;\nvCompo varchar2(32);\nvModul number;\nvRest number;\nvPwd raw(128);\nvKeyRaw1 raw(128):=hextoraw('0123456789ABCDEF');\nvKeyRaw2 raw(128);\nvPwdHash raw(2048);\nvHexstr varchar2(2048);\nvPwdHashStr varchar2(2048);\n\nBegin\nvLeng:=length(vString);\nfor i in 1..vleng\nloop\nvlett:=substr(vString,i,1);\nvCompo:=vCompo||chr(0)||vLett;\nend loop;\nvModul:= mod((vLeng*2),8);\nif (vModul = 0) then\nvRest:= 0;\nelse vRest:=8 - vModul;\nend if;\nfor i in 1..vRest\nloop\nvCompo:=vCompo||chr(0);\nend loop;\nvPwd:=utl_raw.cast_to_raw(vCompo);\ndbms_obfuscation_toolkit.DESEncrypt(input =&gt;vPwd,key=&gt;vKeyRaw1,encrypted_data =&gt;vPwdHash);\nvHexstr:=rawtohex(vPwdHash);\nvLeng:=length(vHexstr);\nvKeyRaw2:=hextoraw(substr(vHexstr,(vLeng-16+1),16));\ndbms_obfuscation_toolkit.DESEncrypt(input =&gt;vPwd,key=&gt;vKeyRaw2,encrypted_data =&gt;vPwdHash);\nvHexstr:=rawtohex(vPwdHash);\nvLeng:=length(vHexstr);\nvPwdHashStr:=substr(vHexstr,(vLeng-16+1),16);\ndbms_output.put_line('Voici la cl\u00e9: '||vPwdHashStr);\nend;\n\/\n\nVoici la cl\u00e9: 5638228DAF52805F \nProc\u00e9dure PL\/SQL termin\u00e9e avec succ\u00e8s.<\/pre>\n<p>On obtient bien la bonne cl\u00e9 qui est 5638228DAF52805F.<\/p>\n<p align=\"justify\">Ce package ne permettra pas de conna\u00eetre le mot de passe, mais de d\u00e9tecter si ce dernier est suffisamment s\u00e9curis\u00e9. Par exemple, ce qui se pratique couramment : UserName=Password. Il donc tr\u00e8s important d&#8217;avoir des\u00a0mots de passe\u00a0suffisamment complexes et longs pour \u00e9viter le d\u00e9cryptage par une attaque de type \u00ab\u00a0Brute Force Attack\u00a0\u00bb. Un simple ordinateur personnel peut lancer 830&#8217;000 tentatives de d\u00e9cryptage de mots de passe \u00e0 la seconde. Ceci reste faible en proportion du nombre de combinaisons possibles pour autant qu&#8217;un mot de passe judicieux ait \u00e9t\u00e9 choisi.<\/p>\n<h3>3. La longueur de la cl\u00e9<\/h3>\n<p align=\"justify\">Il est tr\u00e8s simple de mettre en place un syst\u00e8me qui v\u00e9rifie la complexit\u00e9 des mots de passe saisis afin de ne pas permettre des cl\u00e9s trop simples ou courtes. Pour se faire, il faut installer le package utlpwdmg.sql :<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">SQL&gt; @$ORACLE_HOME\/rdbms\/admin\/utlpwdmg.sql\nFonction cr\u00e9\u00e9e.\nProfil modifi\u00e9.\nFonction cr\u00e9\u00e9e.<\/pre>\n<p>Une fois ce package install\u00e9, il n&#8217;est plus autoris\u00e9 de mettre un mot de passe identique au nom d&#8217;utilisateur ou un mot de passe plus petit que 8 caract\u00e8res.<\/p>\n<pre class=\"brush: sql; gutter: true; first-line: 1\">SQL&gt; create user testpwd identified by testpwd;\ncreate user testpwd identified by testpwd\n*\nERREUR \u00e0 la ligne 1 :\nORA-28003: \u00c9chec de la v\u00e9rification du mot de passe indiqu\u00e9\nORA-20001: Password length less than 8<\/pre>\n<h3>4. Conclusion<\/h3>\n<p>Ce posting met en \u00e9vidence le m\u00e9canisme de cryptage mis en place par Oracle et pr\u00e9sente certains points faibles de ce type de cryptage. M\u00eame si Oracle a fait de grands efforts dans ce domaine (par exemple, rendre le mot de passe &#8220;case sensitive&#8221;).<br \/>\nAujourd&#8217;hui la s\u00e9curit\u00e9 des donn\u00e9es est devenue un th\u00e8me crucial. Pour s&#8217;en rendre compte, il suffit de voir dans l&#8217;actualit\u00e9 les nombreuses attaques ayant cibl\u00e9 en particulier le domaine bancaire ces derniers mois. En g\u00e9n\u00e9ral, ces attaques ne viennent pas de l&#8217;ext\u00e9rieur, mais bien de l&#8217;int\u00e9rieur des entreprises. Il est donc important de sensibiliser les DBA mais \u00e9galement les managers de mani\u00e8re \u00e0 tout mettre en place pour s\u00e9curiser au mieux leurs infrastructures de bases de donn\u00e9es.<br \/>\nUne premi\u00e8re approche consistant \u00e0 la mise en place de best practices telles que celles d\u00e9crites ci-dessous permettent d&#8217;\u00e9viter un bon nombre d&#8217;attaques :<\/p>\n<ul>\n<li>S\u00e9curiser l&#8217;acc\u00e8s \u00e0 la table USER$<\/li>\n<li>S\u00e9curiser l&#8217;acc\u00e8s \u00e0 certains packages<\/li>\n<li>Auditer les tables sensibles<\/li>\n<li>Mettre en place le package de v\u00e9rification de mots de passe<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Quelles sont les faiblesses de l&#8217;encryption des mots de passe Oracle ? Comment est-ce qu&#8217;Oracle cr\u00e9e les cl\u00e9s de hachage afin d&#8217;en am\u00e9liorer la s\u00e9curit\u00e9 ? C&#8217;est ce que je vous propose de d\u00e9couvrir dans ce post. Le mot de passe est la forme la plus commune d&#8217;authentification. Ce dernier est stock\u00e9 dans une table [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[198],"tags":[33,17,25],"type_dbi":[],"class_list":["post-2108","post","type-post","status-publish","format-standard","hentry","category-database-management","tag-oracle-10g-to-8i","tag-oracle-11g","tag-security"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ? - dbi Blog<\/title>\n<meta name=\"description\" content=\"Quelles sont les faiblesses de l&#039;encryption des mots de passe Oracle ? Comment est-ce qu&#039;Oracle cr\u00e9e les cl\u00e9s de hachage afin d&#039;en am\u00e9liorer la s\u00e9curit\u00e9 ? R\u00e9ponses dans ce post.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?\" \/>\n<meta property=\"og:description\" content=\"Quelles sont les faiblesses de l&#039;encryption des mots de passe Oracle ? Comment est-ce qu&#039;Oracle cr\u00e9e les cl\u00e9s de hachage afin d&#039;en am\u00e9liorer la s\u00e9curit\u00e9 ? R\u00e9ponses dans ce post.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2011-01-16T22:00:00+00:00\" \/>\n<meta name=\"author\" content=\"Yann Neuhaus\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yann Neuhaus\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/\"},\"author\":{\"name\":\"Yann Neuhaus\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/5bfc203607127a4915b7950c4a108681\"},\"headline\":\"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?\",\"datePublished\":\"2011-01-16T22:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/\"},\"wordCount\":1498,\"commentCount\":1,\"keywords\":[\"Oracle 10g to 8i\",\"Oracle 11g\",\"Security\"],\"articleSection\":[\"Database management\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/\",\"name\":\"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ? - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2011-01-16T22:00:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/5bfc203607127a4915b7950c4a108681\"},\"description\":\"Quelles sont les faiblesses de l'encryption des mots de passe Oracle ? Comment est-ce qu'Oracle cr\u00e9e les cl\u00e9s de hachage afin d'en am\u00e9liorer la s\u00e9curit\u00e9 ? R\u00e9ponses dans ce post.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/5bfc203607127a4915b7950c4a108681\",\"name\":\"Yann Neuhaus\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2729b4bbf77b0fe6f6d2b9fb1b2686404c89a16ce2701e860bfd1406212f796?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2729b4bbf77b0fe6f6d2b9fb1b2686404c89a16ce2701e860bfd1406212f796?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d2729b4bbf77b0fe6f6d2b9fb1b2686404c89a16ce2701e860bfd1406212f796?s=96&d=mm&r=g\",\"caption\":\"Yann Neuhaus\"},\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/yann-neuhaus\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ? - dbi Blog","description":"Quelles sont les faiblesses de l'encryption des mots de passe Oracle ? Comment est-ce qu'Oracle cr\u00e9e les cl\u00e9s de hachage afin d'en am\u00e9liorer la s\u00e9curit\u00e9 ? R\u00e9ponses dans ce post.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/","og_locale":"en_US","og_type":"article","og_title":"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?","og_description":"Quelles sont les faiblesses de l'encryption des mots de passe Oracle ? Comment est-ce qu'Oracle cr\u00e9e les cl\u00e9s de hachage afin d'en am\u00e9liorer la s\u00e9curit\u00e9 ? R\u00e9ponses dans ce post.","og_url":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/","og_site_name":"dbi Blog","article_published_time":"2011-01-16T22:00:00+00:00","author":"Yann Neuhaus","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Yann Neuhaus","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/"},"author":{"name":"Yann Neuhaus","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/5bfc203607127a4915b7950c4a108681"},"headline":"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?","datePublished":"2011-01-16T22:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/"},"wordCount":1498,"commentCount":1,"keywords":["Oracle 10g to 8i","Oracle 11g","Security"],"articleSection":["Database management"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/","url":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/","name":"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ? - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2011-01-16T22:00:00+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/5bfc203607127a4915b7950c4a108681"},"description":"Quelles sont les faiblesses de l'encryption des mots de passe Oracle ? Comment est-ce qu'Oracle cr\u00e9e les cl\u00e9s de hachage afin d'en am\u00e9liorer la s\u00e9curit\u00e9 ? R\u00e9ponses dans ce post.","breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/pass-words-oracle-vos-mots-de-passe-sont-ils-sris\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Password Oracle : vos mots de passe sont-ils s\u00e9curis\u00e9s ?"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/5bfc203607127a4915b7950c4a108681","name":"Yann Neuhaus","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d2729b4bbf77b0fe6f6d2b9fb1b2686404c89a16ce2701e860bfd1406212f796?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d2729b4bbf77b0fe6f6d2b9fb1b2686404c89a16ce2701e860bfd1406212f796?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d2729b4bbf77b0fe6f6d2b9fb1b2686404c89a16ce2701e860bfd1406212f796?s=96&d=mm&r=g","caption":"Yann Neuhaus"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/yann-neuhaus\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/2108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=2108"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/2108\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=2108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=2108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=2108"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=2108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}