# tnsping and sqlplus Connectivity Checks

- **URL:** https://hackindex.io/services/oracle/enumeration/tnsping-and-sqlplus-connection-checks
- **Path:** Oracle > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/oracle/enumeration.md)
- **Published:** 2026-02-07
- **Updated:** 2026-02-07

## Oracle tnsping sqlplus

tnsping confirms the listener responds to a specific SID or service name without authenticating. sqlplus then confirms whether the connection string is correct by attempting a login: even a credential failure proves the connect string works. Separating these two steps stops wasted time on credential testing with a broken connect string. Run this after SIDs are discovered through [nmap TNS enumeration](https://hackindex.io/services/oracle/enumeration/nmap-tns-listener-enumeration) or [ODAT](https://hackindex.io/services/oracle/enumeration/oracle-listener-enumeration-with-odat).

- tnsping: Validate Listener Response
- Validate All Discovered SIDs
- sqlplus: Confirm Connection String and Test Credentials
- Post-Connection Confirmation Queries

## tnsping: Validate Listener Response

Always use a full connect descriptor rather than relying on a local tnsnames.ora file. This is reproducible from any machine:

```bash
tnsping "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))"
# TNS Ping Utility for Linux: Version 11.2.0.4.0
# Attempting to contact (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=10.10.10.50)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))
# OK (10 msec)
```

```bash
tnsping "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCL)))"
```

`OK (xx msec)` confirms the listener responded and accepts this SID. A `TNS-12514` error means the listener is up but does not know this SID: try other discovered SIDs or switch to SERVICE_NAME format. A `TNS-12541` means the listener is not reachable at all: check the port.

## Validate All Discovered SIDs

```bash
for sid in ORCL XE PROD DEV TEST; do
  echo -n "$sid: "
  tnsping "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=$sid)))" 2>&1 | grep -oE 'OK|TNS-[0-9]+'
done
# ORCL: OK
# XE: TNS-12514
# PROD: OK
# DEV: TNS-12514
# TEST: TNS-12514
```

## sqlplus: Confirm Connection String and Test Credentials

A credential error proves the connect string is correct. A connect identifier error means the SID is wrong: fix this before testing credentials:

```bash
sqlplus -L "$USER/$PASSWORD@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))"
# ERROR:
# ORA-01017: invalid username/password; logon denied
```

ORA-01017 is a good error: the connection string is valid, only the credentials are wrong. Move to [Oracle weak credential testing](https://hackindex.io/services/oracle/vulnerability-discovery/oracle-weak-credentials). ORA-12514 means the SID is wrong: go back to enumeration. ORA-28000 means the account is locked.

```bash
sqlplus -L "system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))"
# SQL>
```

## Post-Connection Confirmation Queries

Once you have a SQL prompt, confirm the context before doing anything else:

```bash
sqlplus -L "system/manager@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=$TARGET_IP)(PORT=1521))(CONNECT_DATA=(SID=ORCL)))" <<EOF
SELECT banner FROM v\$version WHERE ROWNUM=1;
SELECT user FROM dual;
SELECT name FROM v\$database;
EXIT;
EOF
# Oracle Database 11g Enterprise Edition Release 11.2.0.2.0
# SYSTEM
# ORCL
```

## References

- [Oracle Database Documentation](https://docs.oracle.com/en/database/oracle/oracle-database/) - SQL*Plus and connect descriptor reference