Database security assessment

When it applies

An authorized engagement has a reachable database instance — surfaced by network-service-attacks, handed over as a review target, or via app credentials recovered from a config dump. Covers PostgreSQL, MySQL/MariaDB, MSSQL, MongoDB, and Redis. Before touching anything, confirm in scope.txt (see tradecraft-scope-roe): which instances, which accounts, and whether write/delete/exec is permitted. On production systems, default to read-only proofs — no destructive statements unless explicitly allowed.

Why it works

Databases concentrate the crown jewels yet are routinely deployed as "internal-only": bound to 0.0.0.0, default or weak accounts, grants far wider than the app needs, and dangerous features left enabled. Features like xp_cmdshell, COPY ... FROM PROGRAM, UDFs, and Redis's writable config turn a mere database login into OS command execution — so an over-privileged app account is often a quiet path to DBA and then to the host.