← All cheat sheets

🌶 OSCANNER

Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.

oscanner is an Oracle database assessment framework written in Java.
It enumerates Oracle instances, performs SID guessing, password
attacks, and gathers database information for security auditing.

oscanner -s <target>             # Scan Oracle instance
oscanner -s <target> -P <port>   # Scan on custom port

oscanner -s <target>             # Target IP/hostname
oscanner -P <port>               # Oracle port (default: 1521)
oscanner -f <file>               # Output XML report
oscanner -v                      # Verbose output

# 1. Oracle Service Discovery
# - TNS Listener detection
# - Listener version identification
# - Service name enumeration

# 2. SID Enumeration
# - Common SID guessing (ORCL, XE, PROD, etc.)
# - Dictionary-based SID brute force
# - SID extraction from TNS responses

# 3. Default Account Testing
# - Tests common default Oracle credentials
# - SYS, SYSTEM, SCOTT, DBSNMP, etc.
# - Checks for default passwords

# 4. Information Gathering
# - Database version
# - Database links
# - User privileges
# - Available roles
# - Password policy

# Basic Oracle scan
oscanner -s 192.168.1.1

# Scan non-default port
oscanner -s 192.168.1.1 -P 1522

# Scan with XML report
oscanner -s 192.168.1.1 -f report.xml

# Verbose scan
oscanner -s 192.168.1.1 -v

# Username        Password
# SYS             change_on_install
# SYSTEM          manager
# SCOTT           tiger
# DBSNMP          dbsnmp
# OUTLN           outln
# MDSYS           mdsys
# ORDSYS          ordsys
# ORDPLUGINS      ordplugins
# CTXSYS          ctxsys
# WMSYS           wmsys
# XDB             change_on_install
# HR              hr
# OE              oe
# PM              pm
# SH              sh

ORCL                             # Default Oracle SID
XE                               # Express Edition
PROD                             # Production
DEV                              # Development
TEST                             # Testing
DB1                              # Generic
ORADB                            # Oracle DB
APEX                             # APEX
CATALOG                          # Catalog

# tnscmd10g    - TNS listener commands
# sqlplus      - Oracle SQL client
# odat         - Oracle Database Attacking Tool
# sidguesser   - SID brute forcer
# Metasploit   - Oracle auxiliary modules

- Java-based tool
- Requires network access to Oracle TNS port
- Default Oracle port is 1521
- TNS Listener must be accessible
- Account lockout may occur during brute force
- May require Oracle client libraries
- Results help identify Oracle misconfigurations
- Only for authorized database security auditing