database-security

Database Security Assessment

ACTION REQUIRED (execute immediately after reading)

1. NOW: Read precedent-pentest;Destructive statements are prohibited on production databases unless explicitly allowed
2. NOW: In scope, clearly state the instance, account permissions, and whether write/delete is allowed
3. NEXT: Client tool paths
4. ACT: Exposure surface → authentication → authorization → configuration → exploit chain verification (safe)

Applicable scenarios

• Database unauthorized access/weak passwords/incorrect binding to 0.0.0.0
• Excessive privileges, dangerous features (xp_cmdshell, COPY PROGRAM, UDF)
• Lateral movement: from application account to DBA
• NoSQL injection and Redis file writing, etc. (authorized environment)

Workflow

□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限

Toolchain

Tool	Purpose
Official CLI	Connection and enumeration
sqlmap	Injection verification (authorized)
nuclei	Known exposure templates
Cloud RDS console audit	Configuration

Reference

• references/db-misconfig-checklist.md
• ../pentest-tools/ ../cloud-k8s/

Routing context

Upstream: MASTER R35
Downstream: Obtain OS command → attack-chain; cloud-managed → cloud-k8s

Task completion self-check

• Is unauthorized write/delete avoided?
• Is a distinction made between configuration issues and exploitable chains?
• Checklist？