skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-oracle

Tests Oracle TNS Listener services for SID disclosure, weak credentials, and command execution.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#database security#command execution#Oracle#sid bruteforce#tns listener#odat
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-oracle
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-oracle
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-oracle
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-oracle

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Oracle Database assessments require knowing the right sequence of enumeration, authentication, and exploitation steps against the TNS Listener, and missing a SID or default account can stall an entire engagement. This Skill provides a structured workflow for testing Oracle services on ports 1521-1529 during authorized penetration tests.

Core Features & Use Cases

  • Enumeration and Discovery: Identify listener versions, brute force SIDs and service names, and fingerprint accessible accounts using nmap NSE scripts, ODAT, and Metasploit.
  • Authentication Testing: Validate default and weak credentials (system/manager, sys/change_on_install, scott/tiger) with sqlplus, ODAT passwordguesser, hydra, and netexec.
  • Exploitation Primitives: Abuse UTL_FILE for file read/write, external tables, DBMS_SCHEDULER, and Java stored procedures for OS command execution, plus TNS poisoning detection (CVE-2012-1675).
  • Use Case: During an authorized internal pentest, nmap reveals oracle-tns on port 1521. Follow the workflow to brute force the SID, log in with default credentials, dump password hashes from sys.user$, and demonstrate OS command execution as the Oracle service account.

Quick Start

Ask the AI to enumerate the Oracle TNS Listener on the target IP, discover valid SIDs, test default credentials, and attempt ODAT-based file read and command execution.

Frequently Asked Questions about pentesting-oracle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate Oracle SIDs on port 1521?▼

Use nmap with the oracle-sid-brute script or ODAT's sidguesser module to discover valid SIDs like XE or ORCL. A valid SID is required before any authentication attempt against the TNS Listener.

What are common default Oracle database credentials?▼

Well-known defaults include system/manager, sys/change_on_install, scott/tiger, dbsnmp/dbsnmp, and outln/outln. Test them with sqlplus or ODAT's passwordguesser module once a valid SID is known.

How do I execute OS commands through an Oracle database?▼

With valid database credentials, ODAT can abuse external tables, DBMS_SCHEDULER, or Java stored procedures to run OS commands as the Oracle service account. UTL_FILE additionally provides arbitrary file read and write on the database host.

What is TNS poisoning and which Oracle versions are affected?▼

TNS poisoning (CVE-2012-1675) lets an attacker register a rogue instance on an unauthenticated listener and intercept client sessions. Check listener versions against the CVE and test whether tnscmd10g status returns details without a password.

How do I crack Oracle password hashes from sys.user$?▼

Dump name, password, and spare4 columns from sys.user$ with DBA privileges, then crack them with Hashcat. Use mode 3100 for Oracle 10g DES hashes and mode 112 for 11g SHA-1 spare4 hashes.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
ArianHobson333ArianHobson333
7

credential-access

Extract credentials via LSASS dumping, SAM/SECURITY hives, and DPAPI decryption.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

database-enumeration

Enumerate database services and test for default credentials and command execution vulnerabilities.

Official
Intermediate
0x0pointer0x0pointer
13

metasploit

Validate and exploit CVEs with Metasploit in a controlled container.

Official
Advanced