{
  "port": 1521,
  "protocol": "tcp",
  "service": "Oracle Database listener (TNS)",
  "oneLiner": "The Oracle Net listener — the front door to an Oracle database, squatting on a registration for something else entirely.",
  "whatItIs": "Oracle's listener process accepts TNS (Transparent Network Substrate) connections on TCP 1521 by default; the database's PMON registers its services with the listener there, and every sqlplus, JDBC thin, and OCI client connects through it. IANA never assigned 1521 to Oracle — the registry still reads \"ncube-lm\", the nCube License Manager — Oracle simply took the port and the world followed. A TNS listener will answer a version query before you authenticate, and older ones would dump their whole service list to an unauthenticated `lsnrctl status`. On a scan it means a database server, an Oracle E-Business/PeopleSoft tier, or an appliance that embedded Oracle XE.",
  "exposure": {
    "verdict": "never",
    "note": "This is a database's authentication surface with the entire dataset behind it, and TNS has a long CVE history including listener poisoning — bind it to a private interface and reach it over a VPN or SSH tunnel."
  },
  "checkCommand": "nmap -sV -p 1521 TARGET",
  "links": [
    {
      "title": "Oracle Database Net Services Reference — Protocol Address Configuration (default port 1521)",
      "url": "https://docs.oracle.com/en/database/oracle/oracle-database/19/netrf/protocol-address-configuration.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 1521 (registered as ncube-lm, not Oracle)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1521",
      "kind": "iana"
    }
  ]
}