Skip to content
HackIndex logo

HackIndex

Nmap Oracle TNS Listener Enumeration

2 min read Feb 7, 2026

Oracle TNS listener enumeration extracts the listener version and discovers the SIDs and service names needed to attempt database connections. Without a valid SID or service name, no connection is possible regardless of credentials. The listener typically runs on port 1521 but can be on any port. SIDs discovered here feed directly into connectivity checks and credential testing.

Service Detection

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 1521 $TARGET_IP 
1521/tcp open  oracle-tns Oracle TNS listener 11.2.0.2.0

Pull Listener Version

┌──(kali㉿kali)-[~]
└─$ nmap -p 1521 $TARGET_IP --script oracle-tns-version 
| oracle-tns-version:
|   Version: TNSLSNR for Linux: Version 11.2.0.2.0
|   Start Date: 28-MAR-2026 09:00:00
|_  Uptime: 0 days 3 hr. 0 min. 22 sec

The exact version determines which CVEs apply and helps gauge how hardened the installation is. Older versions (10g, 11g) are more likely to have weak default accounts still active. Cross-reference immediately with searchsploit.

SID Discovery

oracle-sid-brute tests common SID names against the listener. Any discovered SID is immediately usable in connection strings:

┌──(kali㉿kali)-[~]
└─$ nmap -p 1521 $TARGET_IP --script oracle-sid-brute 
| oracle-sid-brute:
|   orcl
|   prod
|_  XE
┌──(kali㉿kali)-[~]
└─$ nmap -p 1521 $TARGET_IP --script oracle-sid-brute --script-args 'oracle-sid-brute.sids=ORCL,XE,PROD,DEV,TEST'

Multiple SIDs mean multiple databases behind one listener — treat each as a separate target. XE (Express Edition) is common in lab environments and typically has weaker default configurations. Store all discovered SIDs for use in the next steps.

Run Both Scripts Together

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 1521 --script oracle-tns-version,oracle-sid-brute $TARGET_IP

When Scripts Return Nothing

Some listeners restrict status queries. When nmap returns nothing despite the port being open, fall back to ODAT and direct client probes:

┌──(kali㉿kali)-[~]
└─$ nc -zv $TARGET_IP 1521 && echo 'port reachable' 
Connection to 10.10.10.50 1521 port [tcp/oracle] succeeded!
port reachable

Port reachable but scripts empty means the listener is filtering metadata queries. Move to ODAT listener enumeration and tnsping/sqlplus connectivity checks.

References