Home > Network Pentesting

Database Enumeration

Database enumeration focuses on identifying database services, understanding their configuration, listing users, checking permissions, discovering schemas, and identifying weak authentication. MySQL, MSSQL, and PostgreSQL are widely used, and misconfigurations in any of them can expose sensitive data or allow privilege escalation. Enumeration helps pentesters understand how the databases operate, what information they expose, and how attackers might exploit weaknesses.

Identifying Database Services

Database services usually run on:

  • MySQL: port 3306

  • MSSQL: port 1433

  • PostgreSQL: port 5432

Basic Version Detection

nmap -sV -p3306,1433,5432 10.10.10.5

This reveals service type and version.

Banner Grab

nc -nv 10.10.10.5 3306

Many databases expose version numbers in banners.

MySQL Enumeration

MySQL often exposes version info, authentication behavior, and internal schema details.

Checking MySQL Service

mysql -h 10.10.10.5 -u root -p

A login prompt confirms the service is active.

Checking Anonymous or Weak Login

mysql -h 10.10.10.5 -u root

Some systems allow local or network root login without a password.

Listing Databases

Once authenticated:

SHOW DATABASES;

Checking Users

SELECT user, host FROM mysql.user;

Checking Permissions

SHOW GRANTS FOR 'username'@'host';

Enumerating Tables

USE database_name;
SHOW TABLES;

MySQL misconfigurations often include weak password hashes, open remote access, or anonymous users.

MSSQL Enumeration

MSSQL supports Windows authentication and SQL authentication. It often exposes information via internal metadata.

Checking MSSQL Service with Nmap

nmap --script ms-sql-info -p1433 10.10.10.5

This reveals version, hostname, and instance name.

Using sqsh or mssqlclient.py (Impacket)

mssqlclient.py user@10.10.10.5 -windows-auth

Once connected, pentesters can enumerate system metadata.

Listing Databases

SELECT name FROM sys.databases;

Listing Users

SELECT name FROM sys.sql_logins;

Checking Server Roles

SELECT IS_SRVROLEMEMBER('sysadmin');

Enumerating Tables

SELECT * FROM database_name.sys.tables;

MSSQL misconfigurations often include weak domain integration, excessive privileges, or xp_cmdshell access.

PostgreSQL Enumeration

PostgreSQL uses role-based access. Enumeration focuses on roles, permissions, schemas, and database settings.

Checking PostgreSQL Service

psql -h 10.10.10.5 -U postgres

A prompt indicates the service is active.

Checking for Trust Authentication

Some configurations allow login without a password depending on pg_hba.conf.

Listing Databases

\l

Listing Roles

\du

Switching Database

\c database_name

Listing Tables

\dt

Checking Access Privileges

SELECT * FROM information_schema.role_table_grants;

PostgreSQL misconfigurations include trust authentication, outdated versions, and weak role separation.

Using Nmap NSE Scripts for Databases

Nmap provides scripts for deeper enumeration.

MySQL Scripts

nmap --script mysql-info,mysql-users,mysql-databases -p3306 10.10.10.5

MSSQL Scripts

nmap --script ms-sql-info,ms-sql-ntlm-info -p1433 10.10.10.5

PostgreSQL Scripts

nmap --script pgsql-brute,pgsql-info -p5432 10.10.10.5

These scripts reveal users, version information, and configuration details.

Identifying Misconfigurations

Pentesters check for:

  • Default or weak credentials

  • Anonymous or trust authentication

  • Outdated versions

  • Open remote access

  • Excessive privileges

  • Exposed schema information

  • Weak encryption or plaintext authentication

  • Misconfigured network bindings

These issues often lead to data exposure or full database compromise.

Why Database Enumeration Matters

Databases often store sensitive information such as credentials, logs, business data, and internal configurations. Proper enumeration reveals access paths, privilege levels, and weak authentication settings. Understanding these structures is essential for identifying vulnerable areas and planning secure exploitation techniques.

Intel Dump

  • MySQL runs on 3306, MSSQL on 1433, PostgreSQL on 5432

  • Enumeration checks login behavior, databases, users, roles, and permissions

  • Tools include mysql client, psql, mssqlclient.py, and Nmap scripts

  • Misconfigurations include weak passwords, open remote access, and excessive privileges

  • Database enumeration reveals sensitive data and critical attack paths

HOME LEARN COMMUNITY DASHBOARD