ODAT

Swiss-army knife against Oracle TNS: SIDs, credentials and RCE.

Oracle Database Attacking Tool, the reference against port 1521. It attacks in phases: it guesses the instance **SID** (without it you cannot even attempt to authenticate), tries Oracle's default credentials (there are many and they survive in real installs), and with a valid session escalates to operating-system execution through `utlfile` (upload files) or `externaltable` (run commands). The `all` module chains all of that automatically.

Family Databases

Flags all sidguesser passwordguesser utlfile externaltable

Concepts From version to exploit, Credential Hunting

Cheatsheet Oracle TNS · 1521

Installation

# binario de releases o pip

Repositorygithub.com/quentinhardy/odat

Useful commands4 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.