database-security

Name: database-security
Availability: InStock
Author: chengzongcai

Assess PostgreSQL, MySQL, MSSQL, MongoDB, and Redis instances for exposure, authorization, and misconfiguration risks.

21|8|Updated Aug 3, 2026

Search Tags:#postgresql #redis #penetration testing #database security #mysql #misconfiguration #sqlmap

Ready to run

npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill database-security-chengzongcai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: database-security
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/database-security
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill database-security-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Authorized security teams need a repeatable methodology for auditing database instances instead of guessing commands, covering everything from network exposure to dangerous feature abuse like xp_cmdshell and UDF execution. ## Core Features & Use Cases - Exposure and Authentication Review: Checks for unauthorized access, weak credentials, and instances mistakenly bound to 0.0.0.0. - Privilege and Dangerous Feature Audit: Reviews grants, role separation, file_priv, xp_cmdshell, COPY PROGRAM, and UDF command execution paths. - Use Case: During an authorized pentest, you discover a MySQL instance reachable from the application network. Use this Skill to systematically enumerate accounts, verify least privilege, check whether load_file or UDF paths are exploitable, and document findings against the misconfiguration checklist. ## Quick Start Use the database-security skill to assess this authorized MySQL instance for weak credentials, excessive privileges, and dangerous configuration.

Frequently Asked Questions about database-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I assess a MySQL database for security misconfigurations?▼

Enumerate network exposure and TLS settings, review account grants and role separation, then check dangerous features like file_priv, load_file, and UDF execution paths. Use the included misconfiguration checklist to verify audit logging, backup access, and default accounts.

What tools are used for authorized database penetration testing?▼

Official database CLI clients handle connection and enumeration, sqlmap verifies injection findings in authorized scope, and nuclei runs known-exposure templates. Cloud RDS console auditing covers managed instance configuration review.

Does this cover NoSQL databases like MongoDB and Redis?▼

Yes, the methodology covers MongoDB and Redis alongside PostgreSQL, MySQL, and MSSQL. It includes NoSQL injection scenarios and Redis file-write attack paths, all within authorized testing environments.

Can I run destructive tests against a production database?▼

No, destructive statements against production databases are prohibited unless explicitly authorized. The scope document must record the instance, account permissions, and whether write or delete operations are allowed before testing begins.

What is xp_cmdshell and why is it checked?▼

xp_cmdshell is an MSSQL extended stored procedure that executes operating system commands from SQL. It is checked because enabled dangerous features like it, COPY PROGRAM, or UDFs can escalate database access into full OS command execution.