πŸ““
Sfoffo - Pentesting Notes
View on GitHub
  • 🏠/home/sfoffo/.pt-notes
  • 🏳️Contributions
    • 2024 Contributions
      • CVE-2024-42845
      • CVE-2024-41819
      • CVE-2024-41943
      • CVE-2024-50344
  • πŸ€Support this Project
  • πŸ“‚Active Directory
    • Initial Access
    • Internal Enumeration & Lateral Movement
    • Privilege Escalation to Domain Admin using Known Exploits
    • Domain Trusts
  • 🐧Linux Privilege Escalation
    • Enumerating Attack Vectors
    • Privileged Groups
    • Environment Variables Abuse
    • Capabilities Abuse
    • Programs, Jobs and Services
    • Miscellaneous Techniques
    • Recent CVEs
  • πŸͺŸWindows Privilege Escalation
    • Enumerating Attack Vectors
    • Excessive User Rights Abuse
    • Built-in Groups Abuse
    • File System ACLs
    • Services Hijacking
    • User Account Control (UAC) Bypass
    • Living off the Land
  • πŸ›Bug Bounty Hunting
    • Bug Bounty Tools
  • πŸ•ΈοΈWeb Applications
    • Web Attacks
      • Cross Site Scripting (XSS)
      • SQL Injection (SQLi)
      • File Upload Vulnerabilities
      • Insecure Direct Object References (IDOR)
      • OS Command Injection
      • Local File Inclusion (LFI)
      • Remote File Inclusion (RFI)
      • XML External Entities (XXE)
      • HTTP Verb Tampering
    • Web Technologies
      • Tomcat
      • CGI Applications
      • WordPress
      • WebDav
      • Microsoft IIS
      • SAP Netweaver
      • Joomla
      • Drupal
      • Gitlab
      • Jenkins
      • osTicket
      • PRTG Network Monitor
      • Splunk
    • Fuzzing
  • πŸ”Information Gathering
  • πŸ“œProtocols and Services
    • DNS
    • FTP
    • IMAP
    • IPMI
    • MSSQL
    • MySQL
    • NFS
    • Oracle TNS
    • POP3
    • RDP
    • SMB
    • SMTP
    • SNMP
  • πŸ‘ΎUtilities, Scripts and Payloads
    • Shells and Payloads
    • Metasploit Framework
    • File Transfers
    • Pivoting, Tunneling, Port Forwarding
    • Password Attacks
Powered by GitBook
On this page
  • Introduction
  • Oracle TNS - Basic Commands
  • Oracle RDBMS Interaction Commands

Was this helpful?

Edit on GitHub
  1. Protocols and Services

Oracle TNS

Introduction

  • Communication protocol that facilitates communication between Oracle databases and applications over networks

  • Solution for managing large, complex databases, typically in the healthcare, finance, and retail industries.

  • It has a built-in encryption mechanism that ensures the security of data transmitted.

  • Runs on TCP Port 1521 by default


Oracle TNS - Basic Commands

Command
Description

./odat.py all -s <FQDN/IP>

Perform a variety of scans to gather information about the Oracle database services and its components.

sqlplus /@<FQDN/IP>/

Log in to the Oracle database.

sqlplus username/password@10.129.204.235/XE as sysdba

Log in to the Oracle database with sysdba privileges

./odat.py utlfile -s <FQDN/IP> -d -U -P --sysdba --putFile C:\insert\path file.txt ./file.txt

Upload a file with Oracle RDBMS.

sudo nmap -p1521 -sV 10.129.204.235 --open --script oracle-sid-brute

Nmap SID Bruteforcing


Oracle RDBMS Interaction Commands

Command
Description

select table_name from all_tables;

List all available tables in current database

select name, password from sys.user$;

Extract password hashes

Last updated 1 year ago

Was this helpful?

πŸ“œ