h2-database-pentesting

name	h2-database-pentesting
description	H2 Java SQL database pentesting and exploitation. Use this skill whenever the user mentions H2 database, Java SQL database vulnerabilities, database SQL injection to RCE, unauthenticated database access, or any scenario involving H2 database exploitation. This includes Metabase H2 attacks, database credential testing, and SQL injection payloads targeting H2 databases.

H2 Database Pentesting

A skill for testing and exploiting H2 Java SQL database vulnerabilities.

⚠️ Authorization Required: Only use these techniques on systems you own or have explicit written permission to test.

Overview

H2 is an in-memory Java SQL database commonly used in applications like Metabase. It has several attack vectors including unauthenticated database creation, SQL injection to RCE, and direct database access exploitation.

Attack Vectors

1. Unauthenticated Database Creation

H2 allows creating new databases without valid credentials by specifying a non-existent database name.

When to use: When you have access to an H2 console or connection interface and want to create a database without authentication.

How it works:

• Connect to H2 with a non-existent database name
• H2 will create the database automatically without requiring credentials
• This bypasses authentication entirely

Example connection string:

jdbc:h2:tcp://localhost:9092/NEW_DATABASE_NAME

2. Authenticated Database Access

If you know the database name and credentials, you can access existing H2 databases directly.

When to use: When you have discovered database credentials through other means (config files, environment variables, etc.)

Connection format:

jdbc:h2:tcp://<host>:<port>/<database_name>