skills.rest
chengzongcai
chengzongcaiCOMMUNITY
Explore all skills by this author →
GitHub

database-security

Assess PostgreSQL, MySQL, MSSQL, MongoDB, and Redis instances for exposure, authorization, and misconfiguration risks.

21|8|Updated Aug 3, 2026
Search Tags:#postgresql#redis#penetration testing#database security#mysql#misconfiguration#sqlmap
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill database-security-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: database-security
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/database-security
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill database-security-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Authorized security teams need a repeatable methodology for auditing database instances instead of guessing commands, covering everything from network exposure to dangerous feature abuse like xp_cmdshell and UDF execution. ## Core Features & Use Cases - Exposure and Authentication Review: Checks for unauthorized access, weak credentials, and instances mistakenly bound to 0.0.0.0. - Privilege and Dangerous Feature Audit: Reviews grants, role separation, file_priv, xp_cmdshell, COPY PROGRAM, and UDF command execution paths. - Use Case: During an authorized pentest, you discover a MySQL instance reachable from the application network. Use this Skill to systematically enumerate accounts, verify least privilege, check whether load_file or UDF paths are exploitable, and document findings against the misconfiguration checklist. ## Quick Start Use the database-security skill to assess this authorized MySQL instance for weak credentials, excessive privileges, and dangerous configuration.

Frequently Asked Questions about database-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I assess a MySQL database for security misconfigurations?▼

Enumerate network exposure and TLS settings, review account grants and role separation, then check dangerous features like file_priv, load_file, and UDF execution paths. Use the included misconfiguration checklist to verify audit logging, backup access, and default accounts.

What tools are used for authorized database penetration testing?▼

Official database CLI clients handle connection and enumeration, sqlmap verifies injection findings in authorized scope, and nuclei runs known-exposure templates. Cloud RDS console auditing covers managed instance configuration review.

Does this cover NoSQL databases like MongoDB and Redis?▼

Yes, the methodology covers MongoDB and Redis alongside PostgreSQL, MySQL, and MSSQL. It includes NoSQL injection scenarios and Redis file-write attack paths, all within authorized testing environments.

Can I run destructive tests against a production database?▼

No, destructive statements against production databases are prohibited unless explicitly authorized. The scope document must record the instance, account permissions, and whether write or delete operations are allowed before testing begins.

What is xp_cmdshell and why is it checked?▼

xp_cmdshell is an MSSQL extended stored procedure that executes operating system commands from SQL. It is checked because enabled dangerous features like it, COPY PROGRAM, or UDFs can escalate database access into full OS command execution.

Related Skills

Explore More Software Engineering Skills→
qa-amanqa-aman
19

pentest-scope

Define penetration testing engagement scope with targets, objectives, and authorization.

Community
Intermediate
prowler-cloudprowler-cloud
14.6k

prowler-attack-paths-query

Generate openCypher queries for cloud attack path detection using Cartography schemas.

Official
Advanced
ivanshamaevivanshamaev
14

infra-network-security-review

Harden Kubernetes NetworkPolicies, audit cloud security groups, and validate private network design.

Community
Advanced
vertivolatamvertivolatam
1

Security & Compliance Automation

Automate security and compliance checks for cloud-native environments using OPA, Trivy, and boto3.

Official
Advanced