Hashattack is a tool that can be used to build a table of Oracle password hashes from a dictionary file for a designated username.
Hashes are calculated by creating a user account similar to the target account to be audited and repeatedly changing the password with "ALTER USER" for each dictionary word, storing the hash for each password in a table.
Once the table of hashes is built, a simple SELECT can be issued to determine if the password hash for a target user is a simple dictionary word: SQL> select h.username, h.password, h.hash
2 from hashattack h, dba_users d
3 where d.password = h.hash and h.username = 'SYS';
