Skip to content
HackIndex logo

HackIndex

tnsping and sqlplus Connectivity Checks

2 min read Feb 7, 2026

tnsping confirms the listener responds to a specific SID or service name without authenticating. sqlplus then confirms whether the connection string is correct by attempting a login — even a credential failure proves the connect string works. Separating these two steps stops wasted time on credential testing with a broken connect string. Run this after SIDs are discovered through nmap TNS enumeration or ODAT.

tnsping — Validate Listener Response

Always use a full connect descriptor rather than relying on a local tnsnames.ora file. This is reproducible from any machine:

┌──(kali㉿kali)-[~]
└─$ tnsping "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" 
TNS Ping Utility for Linux: Version 11.2.0.4.0
Attempting to contact (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=10.10.10.50)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))
OK (10 msec)
┌──(kali㉿kali)-[~]
└─$ tnsping "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCL)))"

OK (xx msec) confirms the listener responded and accepts this SID. A TNS-12514 error means the listener is up but does not know this SID — try other discovered SIDs or switch to SERVICE_NAME format. A TNS-12541 means the listener is not reachable at all — check the port.

Validate All Discovered SIDs

┌──(kali㉿kali)-[~]
└─$ for sid in ORCL XE PROD DEV TEST; do
echo -n "$sid: "
tnsping "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=$sid)))" 2>&1 | grep -oE 'OK|TNS-[0-9]+'
done 
ORCL: OK
XE: TNS-12514
PROD: OK
DEV: TNS-12514
TEST: TNS-12514

sqlplus — Confirm Connection String and Test Credentials

A credential error proves the connect string is correct. A connect identifier error means the SID is wrong — fix this before testing credentials:

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" 
ERROR:
ORA-01017: invalid username/password; logon denied

ORA-01017 is a good error — the connection string is valid, only the credentials are wrong. Move to Oracle weak credential testing. ORA-12514 means the SID is wrong — go back to enumeration. ORA-28000 means the account is locked.

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" 
SQL>

Post-Connection Confirmation Queries

Once you have a SQL prompt, confirm the context before doing anything else:

┌──(kali㉿kali)-[~]
└─$ sqlplus -L "system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT banner FROM v\$version WHERE ROWNUM=1;
SELECT user FROM dual;
SELECT name FROM v\$database;
EXIT;
EOF 
Oracle Database 11g Enterprise Edition Release 11.2.0.2.0
SYSTEM
ORCL

References