Databases — Hub
OSCP Database Ports at a Glance
| Port | Service | Primary Tool | Note |
|---|---|---|---|
1433 | MSSQL | MSSQL (impacket-mssqlclient) | xp_cmdshell → RCE |
1521 | Oracle | Oracle (sqlplus, odat) | SID brute first |
3306 | MySQL / MariaDB | MySQL (mysql) | Blank root common |
5432 | PostgreSQL | PostgreSQL (psql) | COPY FROM PROGRAM → RCE |
6379 | Redis | Redis (redis-cli) | Often no auth |
27017 | MongoDB | MongoDB (mongosh) | Often no auth (old installs) |
| (file) | SQLite | SQLite (sqlite3) | .db / .sqlite files — no network port |
OSCP workflow: See open DB port → try default/blank creds → enumerate with client tool → look for file read/write or OS command execution paths.
Install all DB clients: Installation - Kali Setup > 📌 Databases · mysqldump → MySQL > 📌 10) mysqldump — backup / exfiltrate databases
📌 Quick Enumeration Flow
1. Nmap version + scripts
nmap -p PORT -sV --script *-info,*-brute,*-empty-password TARGET
2. Try default credentials
root / blank, sa / blank, postgres / postgres, redis / no auth
3. Connect with native client
mysql, psql, impacket-mssqlclient, redis-cli, mongosh
4. Enumerate
- List databases / schemas
- List tables / collections
- Dump credential tables (users, admin, config)
- Check privileges (FILE, sysadmin, superuser)
5. Escalate
- MySQL: LOAD_FILE / INTO OUTFILE
- MSSQL: xp_cmdshell
- PostgreSQL: COPY FROM PROGRAM
- Redis: SSH key / cron write
- MongoDB: dump creds, check for admin users
- SQLite: find `.db` files → sqlite3 → dump tables (no network port)
📌 Default Credentials to Try
Full list + lab log → Default Credentials
| Database | Username | Password |
|---|---|---|
| MySQL | root | (blank), root, password, mysql |
| MSSQL | sa | (blank), Password123, sa |
| PostgreSQL | postgres | postgres, (blank) |
| Redis | — | (no auth — very common) |
| MongoDB | — | (no auth on old versions) |
| Oracle | SCOTT | TIGER |
| Oracle | SYS | CHANGE_ON_INSTALL |
📌 Brute Force (All DBs)
# MySQL
hydra -l root -P /usr/share/wordlists/rockyou.txt TARGET mysql
# MSSQL
hydra -L users.txt -P passwords.txt TARGET mssql
medusa -h TARGET -U users.txt -P passwords.txt -M mssql
# Connect — domain user needs -windows-auth
impacket-mssqlclient DOMAIN/user:pass@TARGET -windows-auth
impacket-mssqlclient oscp.exam/sql_svc:Dolphin1@TARGET -windows-auth
# PostgreSQL
hydra -l postgres -P /usr/share/wordlists/rockyou.txt TARGET postgres
# CrackMapExec (MSSQL)
crackmapexec mssql TARGET -u sa -p passwords.txt --local-auth
crackmapexec mssql TARGET -d corp.local -u svc_sql -p 'CrackedPassword'📌 Sub-Notes (This Folder)
| Note | Covers |
|---|---|
| MySQL | mysql client — connect, flags, enumeration, LOAD_FILE, INTO OUTFILE |
| MSSQL | impacket-mssqlclient, sqsh — connect, xp_cmdshell, linked servers |
| mysqldump - Windows XAMPP Database Exfiltration | Windows/XAMPP mysqldump.exe — dump DB to .sql, grep creds |
| PowerUpSQL | PowerShell MSSQL discovery + Invoke-SQLOSCmd (Windows shell) |
| PostgreSQL | psql — connect, enumeration, COPY FROM PROGRAM RCE |
| Redis | redis-cli — connect, enumeration, SSH key / cron RCE |
| MongoDB | mongosh — connect, dump collections, no-auth enumeration |
| Oracle | sqlplus, odat — SID brute, default creds, OS command execution |
| SQLite | sqlite3 — file-based .db enum, dump tables, SQLMap --dbms=sqlite |
📌 SQL Injection → Database Access
If you find SQLi on a web app, the database type often maps to these ports:
| SQLi fingerprint | Likely DB | See |
|---|---|---|
@@version, SLEEP() | MySQL | MySQL, SQL Injection |
@@SERVERNAME, WAITFOR DELAY | MSSQL | MSSQL, SQL Injection |
pg_sleep(), version() | PostgreSQL | PostgreSQL, SQL Injection |
FROM dual | Oracle | Oracle, SQL Injection |
sqlite_version() | SQLite | SQLite, SQL Injection |