# Oracle

> Oracle DB attack coverage including TNS listener and SID enumeration, weak credential testing on default accounts, and exploitation for SQL exec, file access, and OS command execution

- **URL:** https://hackindex.io/services/oracle
- **Type:** Service
- **Default ports:** 1521
- **Tags:** oracle, database, listener, network, enumeration
- **Published:** 2026-01-26
- **Updated:** 2026-07-14

Oracle TNS (Transparent Network Substrate) runs on **TCP port 1521** and handles connections to Oracle Database instances. Nmap identifies it as `oracle-tns`. Oracle databases are common in large enterprises, government systems, and financial infrastructure.

The TNS listener reveals version information and registered SIDs (Service Identifiers), which are required to connect to a specific database instance. Default credentials for accounts like `SCOTT/TIGER`, `SYS`, and `SYSTEM` are still found in production. Once authenticated, Oracle's PL/SQL engine and Java components can be leveraged for OS command execution and privilege escalation.

Enumerate SIDs with `odat`, `tnscmd10g`, or Nmap's `oracle-sid-brute` script. Test default credentials with `odat` or `hydra`. After authentication, check for command execution via `DBMS_SCHEDULER`, Java stored procedures, or external tables. Look for sensitive data and linked database connections.

## Phases

- [Enumeration](https://hackindex.io/services/oracle/enumeration.md): Guides for enumerating Oracle TNS listeners, SIDs, and services (3 guides)
- [Vulnerability Discovery](https://hackindex.io/services/oracle/vulnerability-discovery.md): Test Oracle DBs for weak creds on SYS, SYSTEM, SCOTT accounts (1 guides)
- [Exploitation](https://hackindex.io/services/oracle/exploitation.md): SQL exec, file read, OS commands, and shell via Oracle DB (2 guides)