// HackTricks · Network Services

1521, 1522-1529 - Pentesting Oracle TNS Listener

1521, 1522-1529 - Pentesting Oracle TNS Listener

Basic Information

The Oracle Net Listener accepts client connection requests and routes them to registered database services. A default listener uses TCP port 1521, although administrators can configure another available port.[1]

Start by identifying the listener version and the services or SIDs it exposes. Do not assume that every listener on 1521 is vulnerable, and do not brute-force credentials without explicit authorization.

1521/tcp open  oracle-tns    Oracle TNS Listener 9.2.0.1.0 (for 32-bit Windows)
1748/tcp open  oracle-tns    Oracle TNS Listener

Enumeration workflow

  1. Identify the listener: Confirm the service and collect version information.
  2. Enumerate services and SIDs: Query registered database service names before trying a wordlist.
  3. Assess legacy listener controls: Where a legacy listener exposes separately protected administrative operations, test only approved listener credentials; do not confuse this with a database-user login.
  4. Test database credentials: Use discovered service names and an approved credential list.
  5. Assess database privileges: After authentication, determine the account’s effective privileges before testing file access or code-execution paths.

ODAT automates listener, SID, credential, and post-authentication checks; its documentation lists the required Oracle client dependencies and supported modules.[2][5] On Kali, install the packaged dependencies and tool with sudo apt install odat; alternatively, obtain a bundled build from the project’s Releases page.[4][6]

For a lightweight version probe, Nmap provides the oracle-tns-version NSE script.[3]

nmap -sV -p 1521 --script oracle-tns-version <target>
odat all -s <target> -p 1521

The original page also pointed readers to broader Oracle assessment and hardening methodologies. Those remain useful for interpreting findings beyond a single tool run.[7][8][9]

HackTricks Automatic Commands

Protocol_Name: Oracle
Port_Number: 1521
Protocol_Description: Oracle TNS Listener

Entry_1:
  Name: Notes
  Description: Notes for Oracle
  Note: |
    Confirm the listener, enumerate registered services/SIDs, and only then test approved credentials.

Entry_2:
  Name: Nmap
  Description: Nmap with Oracle Scripts
  Command: nmap --script "oracle-tns-version" -p 1521 -T4 -sV {IP}

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.