The Oracle® Hacker's Handbook: Hacking and Defending Oracle

4.1. How Authentication Works

When attempting to log in to the database, the client first connects to the TNS Listener and requests access to database services. The following code shows a packet dump of an example connection:

IP Header
      Length and version: 0×45
      Type of service: 0×00
      Total length: 320
      Identifier: 9373
      Flags: 0×4000
      TTL: 128
      Protocol: 6 (TCP)

Checksum: 0×532d Source IP: 192.168.0.120 Dest IP: 192.168.0.37 TCP Header Source port: 1916 Dest port: 1521 Sequence: 2802498112 ack: 2168229595 Header length: 0×50 Flags: 0×18 (ACK PSH ) Window Size: 17520 Checksum: 0×4915 Urgent Pointer: 0 Raw Data 01 18 00 00 01 00 00 00 01 39 01 2c 00 00 08 00 9 , 7f ff c6 0e 00 00 01 00 00 de 00 3a 00 00 02 00 : 61 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 aa 00 00 00 00 00 00 00 00 00 00 28 44 45 53 43 52 (DESCR 49 50 54 49 4f 4e 3d 28 41 44 44 52 45 53 53 3d IPTION=(ADDRESS= 28 50 52 4f 54 4f 43 4f 4c 3d 54 43 50 29 28 48 (PROTOCOL=TCP)(H 4f 53 54 3d 31 39 32 2e 31 36 38 2e 30 2e 33 37 OST=192.168.0.37 29 28 50 4f 52 54 3d 31 35 32 31 29 29 28 43 4f )(PORT=1521))(CO 4e 4e 45 43 54 5f 44 41 54 41 3d 28 53 45 52 56 NNECT_DATA=(SERV 45 52 3d 44 45 44 49 43 41 54 45 44 29 28 53 45 ER=DEDICATED)(SE 52 56 49 43 45 5f 4e 41 4d 45 3d 6f 72 61 38 31 RVICE_NAME=ora81 37 2e 6e 67 73 73 6f 66 74 77 61 72 65 2e 63 6f 7.ngssoftware.co 6d 29 28 43 49 44 3d 28 50 52 4f 47 52 41 4d 3d m)(CID=(PROGRAM= 43 3a 5c 6f 72 61 63 6c 65 5c 70 72 6f 64 75 63 C:\oracle\produc 74 5c 31 30 2e 32 2e 30 5c 64 62 ...