9.2.8 Determine which database data and operations your identity can access Database Enumeration and Privilege Boundaries

mysql -h TARGET -P PORT -u USER -p

SELECT VERSION(), USER(), CURRENT_USER();
SHOW DATABASES;
SHOW GRANTS;
USE DATABASE;
SHOW TABLES;
DESCRIBE TABLE;
SELECT * FROM TABLE LIMIT 20;
SELECT @@secure_file_priv;

SELECT LOAD_FILE('/path/on/database/server');
SELECT 'probe' INTO OUTFILE '/allowed/server/path/probe.txt';

impacket-mssqlclient 'USER@TARGET'
impacket-mssqlclient 'DOMAIN/USER@TARGET' -windows-auth

Let the tool prompt for the password. At the SQL prompt:

SELECT @@VERSION;
SELECT SYSTEM_USER;
SELECT IS_SRVROLEMEMBER('sysadmin');
SELECT name FROM sys.databases;
USE DATABASE;
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES;
SELECT TOP 20 * FROM SCHEMA.TABLE;

EXEC xp_cmdshell 'whoami';

9.2.8.2.2 MSSQL linked-server and login-context mapping

Treat a linked server as another authentication and authorization boundary. The local SQL login, its mapped remote login, remote SQL role and RPC/data-access settings can all differ.

SELECT SYSTEM_USER AS current_login,
       ORIGINAL_LOGIN() AS original_login,
       SUSER_SNAME() AS effective_login,
       IS_SRVROLEMEMBER('sysadmin') AS is_sysadmin;

SELECT name, product, provider, data_source, is_linked
FROM sys.servers
WHERE is_linked = 1;

EXEC master.dbo.sp_helplinkedsrvlogin;

After selecting one named link, test the smallest remote query supported by its configuration:

EXEC ('SELECT SYSTEM_USER AS remote_login,
              ORIGINAL_LOGIN() AS remote_original_login,
              IS_SRVROLEMEMBER(''sysadmin'') AS remote_is_sysadmin')
AT [LINKED_SERVER];

If RPC execution is disabled but data access is allowed, use a read-only pass-through query instead:

SELECT *
FROM OPENQUERY([LINKED_SERVER],
  'SELECT SYSTEM_USER AS remote_login,
          ORIGINAL_LOGIN() AS remote_original_login');

EXECUTE AS LOGIN = 'LOGIN';
SELECT SYSTEM_USER, ORIGINAL_LOGIN(), SUSER_SNAME(), IS_SRVROLEMEMBER('sysadmin');
REVERT;

Do not enable RPC, create mappings or change server configuration merely to enumerate. A remote SQL query is not OS execution; independently validate any file or command facility and the operating-system identity behind it.

Sources: Microsoft sys.servers, sp_helplinkedsrvlogin, EXECUTE AS, and OPENQUERY.

psql -h TARGET -p PORT -U USER -d postgres

\conninfo
\l
\du
\dn
\dt *.*

SELECT version(), current_user, session_user;
SELECT rolname, rolsuper, rolcreaterole, rolcreatedb
FROM pg_roles;

SELECT pg_has_role(current_user, 'pg_read_server_files', 'member');
SELECT pg_has_role(current_user, 'pg_write_server_files', 'member');
SELECT pg_has_role(current_user, 'pg_execute_server_program', 'member');

Failure cues: connection refusal/timeout is network or listener context; login rejection is authentication/context; an empty database list may be visibility limits; object denial is authorization. Query only bounded rows first. Never assume that reading application credentials or obtaining database admin implies OS execution.

Next action: identify application accounts, hashes/credentials, paths and linked systems; record the precise grant enabling any file or execution primitive; validate recovered credentials in the later credential block and re-enumerate after any identity change.

nmap -Pn -sV --script redis-info -p PORT TARGET
redis-cli -h TARGET -p PORT PING
redis-cli -h TARGET -p PORT INFO
redis-cli -h TARGET -p PORT ACL WHOAMI
redis-cli -h TARGET -p PORT ACL LIST

Authenticated when a password is legitimately known:

redis-cli -h TARGET -p PORT --askpass

Use when the service is MongoDB, commonly TCP/27017. Current installations use mongosh; the old mongo binary may be absent.

9.2.8.6.1 Reachable service without known credentials

# Reachable service without known credentials
mongosh --host TARGET --port PORT

9.2.8.6.2 Known account; -p prompts rather than storing the password in the command

# Known account; -p prompts rather than storing the password in the command
mongosh --host TARGET --port PORT -u USER -p --authenticationDatabase admin

Inside mongosh, choose the real database/collection:

show dbs
use DATABASE
show collections
db.getCollection('COLLECTION').find().limit(5)
db.getCollection('users').findOne({username: 'USER'})

Read: returned documents prove that identity can read those collections. An empty database list can reflect authorization, not an empty server. Classify recovered secrets and use the matching service. Login/operator injection is an application query issue, distinct from direct DB access. Do not overwrite account records just because the repo contains an update example.

Sources: upstream 1.

Use when a downloaded/local application file is SQLite. It is a file format, not a remote listener.

file app.db
sqlite3 -readonly app.db

.tables
.schema users
PRAGMA table_info(users);
SELECT * FROM users LIMIT 5;
.quit

Read: identify the schema and credential format before choosing a recovery mode. Keep the database's provenance and any required WAL/SHM companions; a locked/incomplete copy can give misleading results. Recovered passwords/hashes → the credential procedure, not an assumption of OS or domain access.

Sources: upstream 1.