# 1521,1522-1529 - Pentesting Oracle TNS Listener

<details>

<summary><strong>从零开始学习 AWS 黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS 红队专家）</strong></a><strong>！</strong></summary>

支持 HackTricks 的其他方式：

* 如果您想看到您的**公司在 HackTricks 中做广告**或**下载 PDF 版本的 HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方 PEASS & HackTricks 商品**](https://peass.creator-spring.com)
* 探索[**PEASS 家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFT**](https://opensea.io/collection/the-peass-family)收藏
* **加入** 💬 [**Discord 群组**](https://discord.gg/hRep4RUj7f) 或 [**电报群组**](https://t.me/peass) 或在 **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live) 上**关注**我们。
* 通过向 [**HackTricks**](https://github.com/carlospolop/hacktricks) 和 [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github 仓库提交 PR 来**分享您的黑客技巧**。

</details>

## 基本信息

Oracle 数据库（Oracle DB）是来自 Oracle 公司的关系数据库管理系统（RDBMS）（来自[这里](https://www.techopedia.com/definition/8711/oracle-database)）。

在枚举 Oracle 时，第一步是与通常位于默认端口上的 TNS-Listener 进行通信（1521/TCP，-您也可能在 1522–1529 上获得辅助监听器-）。

```
1521/tcp open  oracle-tns    Oracle TNS Listener 9.2.0.1.0 (for 32-bit Windows)
1748/tcp open  oracle-tns    Oracle TNS Listener
```

## 摘要

1. **版本枚举**：识别版本信息以搜索已知漏洞。
2. **TNS Listener暴力破解**：有时需要建立通信。
3. **SID名称枚举/暴力破解**：发现数据库名称（SID）。
4. **凭证暴力破解**：尝试访问已发现的SID。
5. **代码执行**：尝试在系统上运行代码。

要使用MSF oracle模块，您需要安装一些依赖项：[**安装**](https://github.com/carlospolop/hacktricks/blob/cn/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/oracle-pentesting-requirements-installation.md)

## 帖子

查看这些帖子：

* <https://secybr.com/posts/oracle-pentesting-best-practices/>
* <https://medium.com/@netscylla/pentesters-guide-to-oracle-hacking-1dcf7068d573>
* <https://hackmag.com/uncategorized/looking-into-methods-to-penetrate-oracle-db/>
* <http://blog.opensecurityresearch.com/2012/03/top-10-oracle-steps-to-secure-oracle.html>

## HackTricks自动命令

```
Protocol_Name: Oracle    #Protocol Abbreviation if there is one.
Port_Number:  1521     #Comma separated if there is more than one.
Protocol_Description: Oracle TNS Listener         #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for Oracle
Note: |
Oracle database (Oracle DB) is a relational database management system (RDBMS) from the Oracle Corporation

#great oracle enumeration tool
navigate to https://github.com/quentinhardy/odat/releases/
download the latest
tar -xvf odat-linux-libc2.12-x86_64.tar.gz
cd odat-libc2.12-x86_64/
./odat-libc2.12-x86_64 all -s 10.10.10.82

for more details check https://github.com/quentinhardy/odat/wiki

https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener

Entry_2:
Name: Nmap
Description: Nmap with Oracle Scripts
Command: nmap --script "oracle-tns-version" -p 1521 -T4 -sV {IP}
```

<details>

<summary><strong>从零开始学习AWS黑客技术，成为专家</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE（HackTricks AWS Red Team Expert）</strong></a><strong>！</strong></summary>

其他支持HackTricks的方式：

* 如果您想看到您的**公司在HackTricks中做广告**或**下载PDF格式的HackTricks**，请查看[**订阅计划**](https://github.com/sponsors/carlospolop)!
* 获取[**官方PEASS & HackTricks周边产品**](https://peass.creator-spring.com)
* 探索[**PEASS家族**](https://opensea.io/collection/the-peass-family)，我们的独家[**NFTs**](https://opensea.io/collection/the-peass-family)
* **加入** 💬 [**Discord群**](https://discord.gg/hRep4RUj7f) 或 [**电报群**](https://t.me/peass) 或 **关注**我们的**Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**。**
* 通过向[**HackTricks**](https://github.com/carlospolop/hacktricks)和[**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github仓库提交PR来分享您的黑客技巧。

</details>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://hacktricks.xsx.tw/network-services-pentesting/1521-1522-1529-pentesting-oracle-listener.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.