Intercept the SQL Server Client Login Password

We all know that from winforms applications ProgramTo access the database server, use the connection string. If you are using a user name/password for connection, we usually encrypt the connection string to enhance security. This is far from enough.

Through the network packet capture tool, we can intercept data packets of the TDS protocol adopted by SQL Server. Then you can find the corresponding Logon Message.
Of course, the passwords of logon users are obfuscated, but the obfuscation method is simple. It is very easy to crack.

The obfuscation process is as follows:

Convert password characters to unicode encoding
Swap the 4-bit high and 4-bit low of each byte
The last operation is an exclusive or XOR operation with a constant 0xa5.
This is the final password string.

To crack the attack, perform the opposite operation.

Haha.