Oracle Authentification with a long password (>16 characters)

[k4amos]

In an authentication with an Oracle database, the size of AUTH_PASSWORD will change if the password length exceeds 16 characters, as explained here.
@magnumripper had proposed in this issue #2155 (comment) to add a field with the size of Auth_PASSWORD at the end of the hash, but unfortunately this option doesn't seem to be implemented.

Is there a way to break these hashes with john?

[solardiz]

I skimmed those referenced issues now, and I think this should just work. Have you tried? Unfortunately, we don't seem to have a test vector with a long password - it would be good to add one - maybe you'd contribute that?

add a field with the size of Auth_PASSWORD at the end of the hash, but unfortunately this option doesn't seem to be implemented.

As I understand, this was determined to be unnecessary and redundant - the length is determined from the hex encoding length of the existing field.