Oracle SQL Server

Oracle Database (often referred to as Oracle SQL Server in penetration-testing contexts) is a relational database management system. Oracle’s SQL implementation is a superset of ANSI/ISO SQL, described in the Oracle Database SQL Language Reference.

Enumeration and reconnaissance

Oracle services typically listen on TCP 1521 (the default TNS listener port). Several tools are used to identify and enumerate Oracle instances:

Tool	Purpose
tnscmd10g	Ping an Oracle server, retrieve version information, and interact with the TNS listener
oscanner	Enumerate Oracle server information, including accounts, SIDs, and configuration
sidguess	Dictionary-based enumeration of Oracle System IDs (SIDs)

Usage examples

# Ping an Oracle server, get version information
tnscmd10g $COMMAND -h $IP_ADDRESS
 
# Enumerate information about an Oracle server
oscanner -s $IP_ADDRESS -P $PORT
 
# Dictionary enumeration of Oracle server SIDs
sidguess -i $IP_ADDRESS -d $WORDLIST_FILE

Security considerations

Oracle databases are high-value targets. Common attack vectors include:

• Default or weak credentials — Many Oracle installations ship with well-known default accounts (e.g., scott/tiger, sys/change_on_install).
• TNS listener attacks — The Transparent Network Substrate (TNS) listener can be manipulated to reveal information or execute commands.
• SQL injection — Web applications backed by Oracle are vulnerable to SQL injection; Oracle-specific syntax (e.g., || for concatenation, DUAL table) is used for fingerprinting and exploitation.
• PL/SQL injection — Oracle’s procedural extension can be abused for privilege escalation and command execution.

Sources

• Oracle Database SQL Language Reference, 21c
• tnscmd10g — Kali Linux Tools Documentation
• oscanner — Kali Linux Tools Documentation
• sidguesser — Kali Linux Tools Documentation

Related: tcp, wireshark, sqlmap