skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pentesting-postgresql

Tests PostgreSQL services for weak authentication, privilege escalation, and command execution during authorized engagements.

954|172|Updated Mar 13, 2026
Search Tags:#psql#penetration-testing#privilege-escalation#database-security#postgreSQL#network-services#RCE
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill pentesting-postgresql
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentesting-postgresql
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-services-pentesting/pentesting-postgresql
Command: npx skills add https://github.com/xalgord/xalgorix --skill pentesting-postgresql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, PostgreSQL instances are frequently misconfigured with trust authentication, default credentials, or over-privileged roles, yet testers often miss the exact steps needed to prove real impact such as OS command execution. This Skill provides a structured methodology to enumerate, authenticate, exploit, and escalate against PostgreSQL services with concrete confirmation steps for each finding.

Core Features & Use Cases

  • Authentication Testing: Checks for pg_hba.conf trust authentication, default postgres:postgres credentials, and brute-force logins using hydra, medusa, or netexec.
  • Privilege & Role Enumeration: Extracts roles, password hashes from pg_shadow, installed extensions, and superuser status to map escalation paths.
  • Command Execution & File Access: Demonstrates COPY ... FROM PROGRAM RCE, pg_read_file/lo_import file reads, file writes, CREATEROLE privilege escalation, and config-file RCE via archive_command or preloaded libraries.
  • Use Case: A tester finds port 5432 open, connects with default credentials, confirms superuser status, and proves OS-level command execution by running 'id' through COPY FROM PROGRAM, then documents the finding with evidence and remediation steps.

Quick Start

Ask the AI to test the PostgreSQL service on the target host for trust authentication, weak credentials, and COPY FROM PROGRAM command execution, then report confirmed findings with evidence.

Frequently Asked Questions about pentesting-postgresql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test PostgreSQL for default or weak credentials?▼

Test PostgreSQL authentication by connecting with psql using common defaults like postgres:postgres, or by brute-forcing with hydra, medusa, or netexec against the service. Trust authentication in pg_hba.conf may also allow password-less login, which you confirm when psql connects without prompting.

How to execute OS commands from PostgreSQL?▼

PostgreSQL superusers and members of pg_execute_server_program can run OS commands via COPY ... FROM PROGRAM, available since version 9.3. Create a table, copy command output into it, and select the results to confirm execution, for example by running 'id'.

Can a non-superuser PostgreSQL role be escalated to RCE?▼

Yes, a role with CREATEROLE can grant itself built-in roles like pg_execute_server_program or pg_read_server_files, then use COPY FROM PROGRAM for command execution. It can also reset non-superuser passwords, and local trust sockets can be abused to reach superuser.

What tools are used for PostgreSQL penetration testing?▼

Common tools include psql for direct interaction, nmap for version detection, Metasploit modules like postgres_version and postgres_login, and hydra, medusa, or netexec for password attacks. Hashcat or John can crack dumped pg_shadow md5 or SCRAM-SHA-256 hashes offline.

When should PostgreSQL pentesting techniques be used?▼

These techniques should only be used during authorized engagements with explicit permission from the system owner. They apply when port 5432 is exposed, recovered credentials exist, or roles like CREATEROLE or superuser need validation for real exploitability.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Nmap Recon

Scan targets with Nmap to find open ports and detect services.

Community
Intermediate
dr-robert-lidr-robert-li
27

reporting

Structure WordPress diagnostic findings into audience-tailored reports with severity ratings.

Community
Intermediate
blacklanternsecurityblacklanternsecurity
253

database-enumeration

Enumerate database services and test for default credentials and command execution vulnerabilities.

Official
Intermediate
DCx7C5DCx7C5

metasploit-SKILL.md

Validate scanner findings by confirming exploitability with Metasploit Framework.

Community
Advanced