Today we are going learn how to access the victim machine by cracking the
password of PostgreSQL service.
Disclaimer: The
articles provided on HackWithV is purely for
informational and educational purpose only, and for
those who are willing and curious to know & learn
about Ethical Hacking, Security and Penetration Testing.
Anytime the word "Hacking" that is used on this site
shall be regarded as Ethical Hacking.
What is PostgreSQL?
-
PostgreSQL is an open-source and advanced object-oriented relational
database which is also known as Postgres.
What is Hydra?
-
Hydra is a parallelized login cracker which supports numerous protocols to
attack.
-
New modules are easy to add, beside that, it is flexible and very fast.
-
This tool gives researchers and security consultants the possibility to
show how easy it would be to gain unauthorized access from remote to a
system.
Practical:
-
Attacker: Kali Linux(OS),
Hydra(Tool), Wordlist.
-
Victim: Metasploitable(OS),
PostgreSQL(Service).
-
Here we got the IP (192.168.0.5) of victim. Now lets scan for
PostgreSQL service.
| nmap -sV -p 5432 192.168.0.5 |
-
The nmap says that the victim is running PostgreSQL service. Now its time
for cracking the password of PostgreSQL with the help of Hydra tool.
|
hydra -L users.txt -P passwords.txt 192.168.0.5 postgres
|
-L is list of
usernames
-P is list of Passwords
-
Here we go, the username is postgres and password is postgres.
- Now lets try to connect to PostgreSQL with these credentials.
| psql -U postgres -h 192.168.0.5 |
- Here we got remote login into victim machine PostgreSQL Database.
Be Aware, Be Secure.
Thank You 🙏
Comments
Post a Comment