database-enumeration

Enumerate database services and test for default credentials and command execution vulnerabilities.

253|37|Updated Feb 22, 2026

Search Tags:#database #postgresql #redis #mysql #mongodb #enumeration #mssql

Ready to run

npx skills add https://github.com/blacklanternsecurity/red-run --skill database-enumeration

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: database-enumeration
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/network/database-enumeration
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill database-enumeration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nmap, NetExec, redis-cli, mysql, psql, mongosh, mssqlclient.py, odat, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps penetration testers quickly identify and test for common vulnerabilities in database services, aiming for quick wins like default credentials or unauthenticated access.

Core Features & Use Cases

Service Enumeration: Identifies running database services (MSSQL, MySQL, PostgreSQL, Oracle, MongoDB, Redis) on target ports.
Quick-Win Checks: Tests for default/empty credentials, unauthenticated access, and command execution capabilities.
Use Case: After identifying open database ports during a network reconnaissance phase, this Skill can rapidly assess the security posture of those services for immediate exploitation opportunities.

Quick Start

Use the database-enumeration skill to check for default credentials on MSSQL running on 10.0.0.5.

Frequently Asked Questions about database-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate database services like MySQL and PostgreSQL for default credentials?▼

Database enumeration identifies running MySQL, PostgreSQL, MSSQL, MongoDB, Redis, and Oracle services, then tests them for default or empty credentials and unauthenticated access to find quick exploitation opportunities.

Can I check for command execution vulnerabilities like xp_cmdshell and Redis RCE during database enumeration?▼

Database enumeration assesses discovered services for command execution vulnerabilities, specifically testing for xp_cmdshell in MSSQL, UDF in MySQL, and Redis RCE to enable direct system access.

What tools do I need to perform network reconnaissance on database services?▼

Database enumeration requires tools like nmap for discovery, NetExec for credential testing, and specific clients like psql, mysql, mongosh, redis-cli, mssqlclient.py, and odat for targeted access assessment.

How does database enumeration fit into an offensive security engagement?▼

Database enumeration supports the network reconnaissance and initial access phases of offensive security engagements by rapidly identifying open database ports and assessing their security posture for immediate exploitation.

What is the best way to test unauthenticated access on MongoDB and Redis instances?▼

Database enumeration uses tools like mongosh and redis-cli to test for unauthenticated access on discovered MongoDB and Redis instances, checking if services permit connections without requiring valid credentials.

Does database enumeration work with Oracle databases?▼

Database enumeration supports Oracle databases by utilizing the odat tool to assess running Oracle services for default credentials and command execution vulnerabilities during the initial access phase.