Hacking the world’s most popular database

Oracle Database 23c is presented as both a practical platform to build and a realistic target for ethical penetration testing—using Docker to stand up a local instance, then walking through Oracle’s distinctive architecture (CDB/PDB) before demonstrating how attackers enumerate and guess credentials.

The walkthrough starts by positioning Oracle SQL as “different” from MySQL, especially in how it organizes data and administration. A local Oracle 23c environment is deployed in minutes by installing Docker and running an Oracle 23c free container image with the listener port 1521 exposed. Inside the container, command-line access uses SQL Plus, logging in as the SYSDBA account (the system database administrator) to interact with Oracle’s internal structure.

From there, the core architectural concept is the multitenant model: a Container Database (CDB) root that hosts one or more Pluggable Databases (PDBs). The session shows how Oracle treats each PDB like an isolated “mini-database” with its own namespaces, users, tablespaces, and schemas. The tutorial then creates a new PDB named “matrix,” defines an admin user “Neo” inside it, and opens the PDB so it can be used. A key operational detail follows: users created in a PDB don’t automatically appear in the root container’s user list, and permissions must be granted within the correct container context.

To make Neo functional, the process grants Neo the privileges needed to operate: CREATE SESSION, CREATE TABLE, and UNLIMITED TABLESPACE. The workflow then switches into Neo’s SQL Plus session within the “matrix” PDB and creates a table (“Red Pill db”) with columns for id, name, real name, role, and ability. Data insertion, COMMIT, querying, and deletion mirror common SQL patterns, but the Oracle-specific naming and metadata queries differ—especially when listing tables via USER_TABLES and filtering by the owning user.

A major 23c feature is then introduced: JSON Relational Duality Views. Instead of treating JSON as a separate, awkward format, the example builds relational tables that store JSON-like key/value structures and then creates a duality view that behaves like JSON for application developers. The demonstration emphasizes bidirectional behavior: selecting from the duality view returns JSON-shaped documents, updates to underlying tables automatically reflect in the view, and inserting a pure JSON document into the view updates the relational tables underneath. The result is a blurring of lines between traditional relational SQL and NoSQL-style document workflows.

Finally, the ethical hacking portion uses Odat (run inside Docker) to enumerate and attack an Oracle instance. The approach checks for a reachable TNS listener on port 1521, identifies the correct SID (noting that PDBs share the root SID), and then uses a SID guessing module plus a brute-force-style password guessing module. By adding the expected SID and credentials to the tool’s wordlists, the run succeeds in finding valid SYSDBA credentials (SYS and password), illustrating why attackers focus on system-level accounts and why secure configuration and secrecy of connection details matter. The segment closes by framing the exercise as a high-level but concrete map of how Oracle’s multitenant design and new JSON capabilities intersect with real-world security testing.