DΛΣMӨП

// HackTricks · Network Services

1521, 1522-1529 - Pentesting Oracle TNS Listener

1521, 1522-1529 - Pentesting Oracle TNS Listener

Basic Information

The Oracle Net Listener accepts client connection requests and routes them to registered database services. A default listener uses TCP port 1521, although administrators can configure another available port.[1]

Start by identifying the listener version and the services or SIDs it exposes. Do not assume that every listener on 1521 is vulnerable, and do not brute-force credentials without explicit authorization.

1521/tcp open  oracle-tns    Oracle TNS Listener 9.2.0.1.0 (for 32-bit Windows)
1748/tcp open  oracle-tns    Oracle TNS Listener

Enumeration workflow

  1. Identify the listener: Confirm the service and collect version information.
  2. Enumerate services and SIDs: Query registered database service names before trying a wordlist.
  3. Assess legacy listener controls: Where a legacy listener exposes separately protected administrative operations, test only approved listener credentials; do not confuse this with a database-user login.
  4. Test database credentials: Use discovered service names and an approved credential list.
  5. Assess database privileges: After authentication, determine the account’s effective privileges before testing file access or code-execution paths.

ODAT automates listener, SID, credential, and post-authentication checks; its documentation lists the required Oracle client dependencies and supported modules.[2][5] On Kali, install the packaged dependencies and tool with sudo apt install odat; alternatively, obtain a bundled build from the project’s Releases page.[4][6]

For a lightweight version probe, Nmap provides the oracle-tns-version NSE script.[3]

nmap -sV -p 1521 --script oracle-tns-version <target>
odat all -s <target> -p 1521

The original page also pointed readers to broader Oracle assessment and hardening methodologies. Those remain useful for interpreting findings beyond a single tool run.[7][8][9]

HackTricks Automatic Commands

Protocol_Name: Oracle
Port_Number: 1521
Protocol_Description: Oracle TNS Listener

Entry_1:
  Name: Notes
  Description: Notes for Oracle
  Note: |
    Confirm the listener, enumerate registered services/SIDs, and only then test approved credentials.

Entry_2:
  Name: Nmap
  Description: Nmap with Oracle Scripts
  Command: nmap --script "oracle-tns-version" -p 1521 -T4 -sV {IP}

References