skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

database-tactics

Guides penetration testing attacks against Redis, MSSQL, PostgreSQL, MySQL, and MongoDB services.

1.7k|238|Updated Dec 7, 2019
Search Tags:#penetration testing#Redis#brute force#MSSQL#postgreSQL#RCE#Privilege escalation
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill database-tactics
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: database-tactics
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/postexploit/product/database-tactics
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill database-tactics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

During internal network penetration tests, discovered database services often provide the fastest path to remote code execution and privilege escalation, but each database engine requires different exploitation techniques that testers must recall under time pressure.

Core Features & Use Cases

  • Multi-Database Coverage: Provides attack workflows for Redis (6379), MSSQL (1433), PostgreSQL (5432), MySQL (3306), and MongoDB (27017), prioritized by exploitation probability.
  • Phased Methodology: Walks through service identification, unauthorized access checks, weak password brute-forcing with netexec, command execution, file read/write, and OS-level privilege escalation.
  • In-Depth References: Includes detailed attack guides for Redis (unauthorized access, master-slave replication RCE, Lua sandbox escape), MSSQL (xp_cmdshell, CLR assembly, NTLM hash theft), and PostgreSQL (COPY FROM PROGRAM, UDF, privilege escalation).
  • Use Case: When a port scan reveals an open Redis 6379 service on a target, follow the quick-reference section to test unauthorized access, then write an SSH key or webshell to gain a foothold.

Quick Start

Ask the AI to help you attack the discovered Redis service on port 6379 of the target host using this database attack methodology.

Frequently Asked Questions about database-tactics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Redis unauthorized access on port 6379?▼

Connect with redis-cli and check if the ping command returns PONG without authentication. If accessible, write a webshell, SSH public key, or crontab entry to gain code execution, or use master-slave replication to load a malicious module for RCE.

How to execute system commands through MSSQL with sa credentials?▼

Enable xp_cmdshell via sp_configure, then execute OS commands directly through it. If xp_cmdshell is blocked, alternatives include OLE Automation procedures, SQL Server Agent Jobs, or loading a custom CLR assembly for .NET code execution.

What tools brute-force database passwords during a pentest?▼

Netexec supports password spraying against MSSQL and other protocols with username and password lists. Hydra works for Redis, and common default credentials like sa/sa, postgres/postgres, and root/root should be tested first.

Can PostgreSQL superuser access lead to OS command execution?▼

Yes, PostgreSQL 9.3 and later allow superusers to run system commands via COPY FROM PROGRAM. Alternative paths include C-language UDFs or PL/Python and PL/Perl extensions when COPY FROM PROGRAM is restricted.

Why does xp_cmdshell fail even with valid MSSQL credentials?▼

xp_cmdshell is disabled by default in modern SQL Server versions and requires sysadmin privileges to enable via sp_configure. If enabling fails, use OLE Automation, Agent Jobs, or CLR assembly attacks as fallback execution methods.

What are the limitations of database-based privilege escalation?▼

Database attacks typically yield the service account context, such as the postgres or mssql user, not root directly. Further OS-level escalation depends on sudo misconfigurations, writable crontabs, or kernel vulnerabilities on the target host.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
0x0pointer0x0pointer
13

lateral-movement

Identify and exploit Active Directory lateral movement paths using credential reuse and relay techniques.

Official
Advanced
trilwutrilwu
109

cracking-passwords

Identify hash types and crack password hashes with hashcat or John the Ripper.

Community
Advanced
SnailSploitSnailSploit
2.9k

rce

Identify and exploit Remote Code Execution vulnerabilities across web applications and infrastructure.

Community
Advanced