# Oracle Listener Enumeration with ODAT

- **URL:** https://hackindex.io/services/oracle/enumeration/oracle-listener-enumeration-with-odat
- **Path:** Oracle > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/oracle/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-05-15

## ODAT Oracle Enumeration

ODAT (Oracle Database Attacking Tool) provides direct TNS listener interaction through its tnscmd module. It is useful when nmap NSE scripts are blocked or return incomplete results. The TNS listener sits on port 1521 by default and acts as the entry point for all Oracle database connections. Without a valid SID or service name from the listener, no database client can connect. tnscmd sends raw TNS protocol packets and parses the responses directly, without requiring Oracle instant client libraries installed on your attacker machine. This matters on engagements where client libraries are unavailable or where the connection string structure is unknown. This page covers enumeration only: ping, status, version, and services. ODAT also has post-authentication exploitation modules covered separately. Results from services enumeration feed into [tnsping/sqlplus connectivity checks](https://hackindex.io/services/oracle/enumeration/tnsping-and-sqlplus-connection-checks).

- Install ODAT
- Confirm Listener Reachability
- Pull Version and Status
- Enumerate Services and SIDs
- Run All tnscmd Checks Together

> [!CAUTION]
> ODAT has exploitation modules beyond tnscmd. Do not use those in OSCP exam environments: only tnscmd enumeration is permitted in most exam scenarios. Check your exam rules before using any tool.

## Install ODAT

pipx installs ODAT into an isolated environment and puts the `odat` command on your path globally. If pipx is unavailable, clone the repo and create a virtual environment manually using the fallback command shown. Oracle instant client libraries are required for some ODAT modules, but the tnscmd module used on this page works without them. Confirm the install succeeded by running `odat --help` and checking that the tnscmd module appears in the output.

```bash
pipx install odat 2>/dev/null || (git clone https://github.com/quentinhardy/odat && cd odat && python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt)
```

## Confirm Listener Reachability

Run the ping check before any other tnscmd operation. A positive response confirms the listener is running and accepting TNS packets on the target port. If the check fails with a timeout, the port is likely filtered by a firewall dropping packets rather than actively rejecting them. A connection refused error means the listener process is not running. If the default port 1521 is unreachable, try common alternatives: 1522, 1526, and 1575 are used in some Oracle configurations. A reachable listener does not guarantee database access, but it confirms you have a valid target for further enumeration.

```bash
odat tnscmd -s $TARGET_IP -p 1521 --ping
# [+] The TNS listener on 10.10.10.50:1521 is reachable
```

## Pull Version and Status

The version string identifies the Oracle release running behind the listener. Older releases such as Oracle 11g (11.2.x) and 10g are frequently unpatched in lab and CTF environments and expose known public CVEs. Note the full version string including the sub-version number, as patch levels within a major release vary significantly in vulnerability exposure. The uptime and start date from the status output confirm you are talking to the active production listener rather than a secondary or standby instance.

```bash
odat tnscmd -s $TARGET_IP -p 1521 --version
# [+] TNSLSNR for Linux: Version 11.2.0.2.0 - Production
```

```bash
odat tnscmd -s $TARGET_IP -p 1521 --status
# [+] Alias: LISTENER
# [+] Version: TNSLSNR for Linux: Version 11.2.0.2.0
# [+] Start Date: 28-MAR-2026 09:00:00
# [+] Uptime: 0 days 3 hr. 0 min. 22 sec
# [+] Security: OFF
```

`Security: OFF` in the status output means the listener is not password-protected. This is a misconfiguration common on older Oracle installations. It allows unauthenticated listener commands, including remote administration via SET commands. With no listener password set, an attacker can issue administrative commands to stop or reload the listener without credentials. `Security: ON` means a password is set at the listener level, separate from any database credentials. Even with `Security: ON`, SID and service enumeration often still works because those queries do not require listener-level authentication in all Oracle versions.

## Enumerate Services and SIDs

Services and SIDs from the listener response are the identifiers required for database connection strings. The `--status` flag dumps all registered services and their current state. Each service name corresponds to a database instance or, in Oracle 12c and later, a pluggable database (PDB). Collect every identifier the listener reports, including those in non-READY states, because database names are useful for brute-forcing SIDs when the listener does not respond to service queries directly.

```bash
odat tnscmd -s $TARGET_IP -p 1521 --status
# [+] Service name: ORCL
# [+] Instance name: ORCL
# [+] Status: READY
# [+] Service name: ORCLXDB
# [+] Instance name: ORCL
```

READY instances are active databases accepting connections. Use returned service names directly in connect strings. ORCLXDB is the XML DB service and also exposes a separate HTTP interface on port 8080 by default. Check whether that port is open and probe it independently. BLOCKED instances are registered with the listener but not currently accepting connections. Note every identifier returned, including BLOCKED ones, as the database names are useful input for SID brute-forcing with tools like odat sidguesser. Map all discovered identifiers to [tnsping validation](https://hackindex.io/services/oracle/enumeration/tnsping-and-sqlplus-connection-checks) before moving to credential testing.

## Run All tnscmd Checks Together

Running all flags in a single command reduces round trips and keeps the output together for notes and reporting. Redirect the output to a file for reference during later phases. If any individual check returns incomplete data, run it again in isolation to determine whether the issue is transient or caused by a specific check conflicting with listener state. This combined command is a good default first pass on any Oracle target before deciding which follow-up steps are warranted.

```bash
odat tnscmd -s $TARGET_IP -p 1521 --ping --version --status 2>/dev/null
```

## References

- [ODAT](https://github.com/quentinhardy/odat) - Oracle Database Attacking Tool: tnscmd module and installation