# Nmap Oracle TNS Listener Enumeration

- **URL:** https://hackindex.io/services/oracle/enumeration/nmap-tns-listener-enumeration
- **Path:** Oracle > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/oracle/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-02-07

## Oracle TNS Enumeration

Oracle TNS listener enumeration extracts the listener version and discovers the SIDs and service names needed to attempt database connections. Without a valid SID or service name, no connection is possible regardless of credentials. The listener typically runs on port 1521 but can be on any port. SIDs discovered here feed directly into [connectivity checks](https://hackindex.io/services/oracle/enumeration/tnsping-and-sqlplus-connection-checks) and [credential testing](https://hackindex.io/services/oracle/vulnerability-discovery/oracle-weak-credentials).

- Service Detection
- Pull Listener Version
- SID Discovery
- Run Both Scripts Together
- When Scripts Return Nothing

## Service Detection

```bash
nmap -sV -p 1521 $TARGET_IP
# 1521/tcp open  oracle-tns Oracle TNS listener 11.2.0.2.0
```

## Pull Listener Version

```bash
nmap -p 1521 $TARGET_IP --script oracle-tns-version
# | oracle-tns-version:
# |   Version: TNSLSNR for Linux: Version 11.2.0.2.0
# |   Start Date: 28-MAR-2026 09:00:00
# |_  Uptime: 0 days 3 hr. 0 min. 22 sec
```

The exact version determines which CVEs apply and helps gauge how hardened the installation is. Older versions (10g, 11g) are more likely to have weak default accounts still active. Cross-reference immediately with searchsploit.

## SID Discovery

oracle-sid-brute tests common SID names against the listener. Any discovered SID is immediately usable in connection strings:

```bash
nmap -p 1521 $TARGET_IP --script oracle-sid-brute
# | oracle-sid-brute:
# |   orcl
# |   prod
# |_  XE
```

```bash
echo -e 'ORCL\nXE\nPROD\nDEV\nTEST' > /tmp/oracle-sids.txt
nmap -p 1521 $TARGET_IP --script oracle-sid-brute --script-args oraclesids=/tmp/oracle-sids.txt
```

Multiple SIDs mean multiple databases behind one listener: treat each as a separate target. XE (Express Edition) is common in lab environments and typically has weaker default configurations. Store all discovered SIDs for use in the next steps.

## Run Both Scripts Together

```bash
nmap -sV -p 1521 --script oracle-tns-version,oracle-sid-brute $TARGET_IP
```

## When Scripts Return Nothing

Some listeners restrict status queries. When nmap returns nothing despite the port being open, fall back to ODAT and direct client probes:

```bash
nc -zv $TARGET_IP 1521 && echo 'port reachable'
# Connection to 10.10.10.50 1521 port [tcp/oracle] succeeded!
# port reachable
```

Port reachable but scripts empty means the listener is filtering metadata queries. Move to [ODAT listener enumeration](https://hackindex.io/services/oracle/enumeration/oracle-listener-enumeration-with-odat) and [tnsping/sqlplus connectivity checks](https://hackindex.io/services/oracle/enumeration/tnsping-and-sqlplus-connection-checks).

## References

- [nmap: oracle-tns-version NSE](https://nmap.org/nsedoc/scripts/oracle-tns-version.html) - Listener version detection
- [nmap: oracle-sid-brute NSE](https://nmap.org/nsedoc/scripts/oracle-sid-brute.html) - Common SID discovery against TNS listener