Service

Oracle

Oracle DB attack coverage including TNS listener and SID enumeration, weak credential testing on default accounts, and exploitation for SQL exec, file access, and OS command execution

:1521 6 guides 3 phases

1 min read Created: Jan 26, 2026 Updated: Jul 14, 2026

Oracle TNS (Transparent Network Substrate) runs on TCP port 1521 and handles connections to Oracle Database instances. Nmap identifies it as oracle-tns. Oracle databases are common in large enterprises, government systems, and financial infrastructure.

The TNS listener reveals version information and registered SIDs (Service Identifiers), which are required to connect to a specific database instance. Default credentials for accounts like SCOTT/TIGER, SYS, and SYSTEM are still found in production. Once authenticated, Oracle's PL/SQL engine and Java components can be leveraged for OS command execution and privilege escalation.

Enumerate SIDs with odat, tnscmd10g, or Nmap's oracle-sid-brute script. Test default credentials with odat or hydra. After authentication, check for command execution via DBMS_SCHEDULER, Java stored procedures, or external tables. Look for sensitive data and linked database connections.