Skip to content
HackIndex logo

HackIndex

Oracle Listener Enumeration with ODAT

2 min read May 15, 2026

ODAT (Oracle Database Attacking Tool) provides direct TNS listener interaction through its tnscmd module — useful when nmap NSE scripts are blocked or return incomplete results. This page covers enumeration only: ping, status, version, and services. ODAT also has post-authentication exploitation modules covered separately. Results from services enumeration feed into tnsping/sqlplus connectivity checks.

Install ODAT

┌──(kali㉿kali)-[~]
└─$ pipx install odat 2>/dev/null || (git clone https://github.com/quentinhardy/odat && cd odat && python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt)

Confirm Listener Reachability

┌──(kali㉿kali)-[~]
└─$ odat tnscmd -s $TARGET_IP -p 1521 --ping 
[+] The TNS listener on 10.10.10.50:1521 is reachable

Pull Version and Status

┌──(kali㉿kali)-[~]
└─$ odat tnscmd -s $TARGET_IP -p 1521 --version 
[+] TNSLSNR for Linux: Version 11.2.0.2.0 - Production
┌──(kali㉿kali)-[~]
└─$ odat tnscmd -s $TARGET_IP -p 1521 --status 
[+] Alias: LISTENER
[+] Version: TNSLSNR for Linux: Version 11.2.0.2.0
[+] Start Date: 28-MAR-2026 09:00:00
[+] Uptime: 0 days 3 hr. 0 min. 22 sec
[+] Security: OFF

Security: OFF in the status output means the listener is not password-protected — a misconfiguration on older Oracle installations that allows unauthenticated listener commands including remote administration.

Enumerate Services and SIDs

┌──(kali㉿kali)-[~]
└─$ odat tnscmd -s $TARGET_IP -p 1521 --services 
[+] Service name: ORCL
[+] Instance name: ORCL
[+] Status: READY
[+] Service name: ORCLXDB
[+] Instance name: ORCL

READY instances are active databases. Use returned service names directly in connect strings. ORCLXDB is the XML DB service — sometimes accessible separately and worth probing. Map all discovered identifiers to tnsping validation before moving to credential testing.

Run All tnscmd Checks Together

┌──(kali㉿kali)-[~]
└─$ odat tnscmd -s $TARGET_IP -p 1521 --ping --version --status --services 2>/dev/null

References