Skip to main content
protocols.pageprotocols.page
1521

Port 1521 – Oracle Database

TCP

Port 1521 is the Oracle Database TNS (Transparent Network Substrate) listener port. The TNS listener accepts client connections and routes them to the appropriate database instance. Exposing port 1521 to the internet enables brute-force attacks against database accounts and exploitation of unpatched Oracle vulnerabilities.

Port Number

1521

Protocol

TCP

Service

Oracle TNS Listener

Range

IANA Registered (1024–49151)

Description

Oracle TNS Listener on port 1521 is the gateway to Oracle Database instances. Clients connect to the listener with a connection string specifying the service name or SID, and the listener routes them to the correct database process. A single listener can serve multiple database instances. The TNS Listener has a history of critical vulnerabilities – TNS Poison (CVE-2012-1675) allowed man-in-the-middle attacks on database connections. Oracle databases should never have port 1521 exposed to untrusted networks. Use Oracle Connection Manager or SSH tunneling for remote access. Enable TNS encryption (Oracle Native Encryption or TLS) to protect credentials and query data in transit.

Security risks

  • 1CVE-2012-1675: Oracle TNS Listener poisoning – unauthenticated attacker registers a rogue database instance, intercepting client connections (man-in-the-middle without patching the listener)
  • 2CVE-2018-3110: Oracle Database Java VM RCE – authenticated user with CREATE SESSION privilege achieves OS-level code execution (CVSS 9.9)
  • 3Default SID/service names: ORCL, XE, ORCLPDB are scanned globally. Discovery via SID bruteforce (odat sidguesser, nmap oracle-sid-brute) reveals valid database targets
  • 4TNS Listener unencrypted by default: all SQL, data, and credentials traverse port 1521 in cleartext unless Oracle Native Encryption or TLS is explicitly configured
  • 5Database link abuse: once connected, attackers use database links (@DBLINK) to pivot to other Oracle databases on the internal network without additional authentication

Firewall guidance

Never expose port 1521 to the internet. Use Oracle Connection Manager (CMAN) or SSH tunneling for remote DBA access. Restrict to application server IPs only. Enable Oracle Native Network Encryption (SQLNET.ENCRYPTION_SERVER=REQUIRED in sqlnet.ora) or configure TLS on port 2484. Set VALID_NODE_CHECKING_REGISTRATION_LISTENER=ON to prevent TNS poisoning.

Diagnosis commands

Test TNS connectivity to the listener

shell
tnsping ORCL

Show listener status, registered services, and connection count

shell
lsnrctl status

Brute-force Oracle SID names (security audit)

shell
nmap -p 1521 --script oracle-sid-brute target

List unlocked database accounts (check for defaults)

shell
sqlplus -s / as sysdba <<< "SELECT username,account_status FROM dba_users WHERE account_status='OPEN';"

Usage examples

Port 1521 – Oracle Database
shell
sqlplus user/pass@//host:1521/ORCL
tnsping ORCL
lsnrctl status LISTENER

Common services on this port

Oracle Database (Enterprise, Standard, Express)Oracle RACOracle Autonomous Database (managed)Oracle Cloud Infrastructure

Related ports

1521

Oracle TNS Listener (this port)

1522

Oracle TNS alternate (RAC)

1630

Oracle Connection Manager (CMAN)

2484

Oracle TLS Listener

History

Oracle Database has used port 1521 for the TNS (Transparent Network Substrate) Listener since Oracle 7 (1992). TNS is Oracle's proprietary network protocol. The listener acts as a broker – clients connect to 1521, request a specific SID/service name, and the listener hands off the connection. Oracle 12c (2013) introduced multitenant architecture (CDB/PDB). Oracle Autonomous Database (2018) provides managed service eliminating direct port exposure.

FAQ

How do I encrypt Oracle TNS traffic?

Option 1 (easiest): Oracle Native Network Encryption – add to sqlnet.ora: SQLNET.ENCRYPTION_SERVER=REQUIRED, SQLNET.ENCRYPTION_TYPES_SERVER=(AES256). No cert management needed, transparent to applications. Option 2 (strongest): TLS/SSL – configure wallet with certificates, listener on port 2484, TCPS protocol in tnsnames.ora. Cloud: Oracle Autonomous DB uses TLS by default with mutual TLS (mTLS) wallets.

What are the most dangerous default Oracle accounts?

SYS/SYSTEM (DBA), DBSNMP (monitoring, often password=dbsnmp), SCOTT/TIGER (demo), HR/HR (sample schema), OUTLN/OUTLN (plan stability). Oracle 12c+ locks most defaults and enforces password changes at install. On older versions: ALTER USER account ACCOUNT LOCK for all unused accounts. Never change SYS/SYSTEM to simple passwords – they have DBA privilege.