PostgreSQL injection
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-e70bceed6fa35760d025f037a78106ab025a68cd%252Fimage%2520%281%29%2520%281%29%2520%281%29%2520%281%29%2520%281%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=4e73b8f0&sv=1)
If you are interested in hacking career and hack the unhackable - we are hiring! (kuandika na kuzungumza kwa Kiswahili ni lazima).
This page aims to explain different tricks that could help you to exploit a SQLinjection found in a postgresql database and to compliment the tricks you can find on https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md
Network Interaction - Privilege Escalation, Port Scanner, NTLM challenge response disclosure & Exfiltration
The PostgreSQL module dblink
offers capabilities for connecting to other PostgreSQL instances and executing TCP connections. These features, combined with the COPY FROM
functionality, enable actions like privilege escalation, port scanning, and NTLM challenge response capture. For detailed methods on executing these attacks check how to perform these attacks.
Exfiltration example using dblink and large objects
You can read this example to see a CTF example of how to load data inside large objects and then exfiltrate the content of large objects inside the username of the function dblink_connect
.
PostgreSQL Attacks: Read/write, RCE, privesc
Check how to compromise the host and escalate privileges from PostgreSQL in:
5432,5433 - Pentesting PostgresqlWAF bypass
PostgreSQL String functions
Manipulating strings could help you to bypass WAFs or other restrictions. In this page you can find some useful Strings functions.
Stacked Queries
Remember that postgresql support stacked queries, but several application will throw an error if 2 responses are returned when expecting just 1. But, you can still abuse the stacked queries via Time injection:
XML tricks
query_to_xml
Hii kazi itarudisha data zote katika muundo wa XML katika faili moja tu. Ni bora ikiwa unataka kutupa data nyingi katika safu moja tu:
database_to_xml
Hii kazi itatoa hifadhidata nzima katika muundo wa XML kwa mstari 1 tu (kuwa makini ikiwa hifadhidata ni kubwa sana kwani unaweza kuisababisha DoS au hata mteja wako mwenyewe):
Strings in Hex
Ikiwa unaweza kuendesha queries ukipitia ndani ya string (kwa mfano kutumia query_to_xml
function). Unaweza kutumia convert_from kupitisha string kama hex na kupita filters kwa njia hii:
Nukuu zilizokatazwa
Ikiwa huwezi kutumia nukuu kwa payload yako unaweza kupita hii kwa CHR
kwa masharti ya msingi (kuunganisha wahusika kunafanya kazi tu kwa maswali ya msingi kama vile SELECT, INSERT, DELETE, nk. Hakiwezi kufanya kazi kwa taarifa zote za SQL):
Au na $
. Hizi maswali yanarudisha matokeo sawa:
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-e70bceed6fa35760d025f037a78106ab025a68cd%252Fimage%2520%281%29%2520%281%29%2520%281%29%2520%281%29%2520%281%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=4e73b8f0&sv=1)
Ikiwa unavutiwa na kazi ya uhalifu wa mtandao na kujaribu kuvunja yasiyovunjika - tunatafuta wafanyakazi! (kuandika na kuzungumza kwa ufasaha Kiswahili kunahitajika).
Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated