|
| 1 | +<h3 id="information-gathering">Information Gathering</h3> |
| 2 | + |
| 3 | +<p class="pageDescription">{{site.data.injectionDescriptions.informationGathering}}</p> |
| 4 | + |
| 5 | +<table class="table table-striped table-hover"> |
| 6 | + <thead> |
| 7 | + <tr> |
| 8 | + <th>Description</th> |
| 9 | + <th>Query</th> |
| 10 | + </tr> |
| 11 | + </thead> |
| 12 | + <tbody> |
| 13 | + <tr> |
| 14 | + <td>Version</td> |
| 15 | + <td>SELECT version();</td> |
| 16 | + </tr> |
| 17 | + <tr> |
| 18 | + <td>User</td> |
| 19 | + <td> |
| 20 | + SELECT user;<br> |
| 21 | + SELECT current_user;<br> |
| 22 | + SELECT session_user;<br> |
| 23 | + SELECT usename FROM pg_user;<br> |
| 24 | + SELECT getpgusername(); |
| 25 | + </td> |
| 26 | + </tr> |
| 27 | + <tr> |
| 28 | + <td>Users</td> |
| 29 | + <td>SELECT usename FROM pg_user</td> |
| 30 | + </tr> |
| 31 | + <tr> |
| 32 | + <td>User Password Hashes</td> |
| 33 | + <td>SELECT usename, passwd FROM pg_shadow</td> |
| 34 | + </tr> |
| 35 | + <tr> |
| 36 | + <td>Privileges</td> |
| 37 | + <td>SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user</td> |
| 38 | + </tr> |
| 39 | + <tr> |
| 40 | + <td>List DBA Accounts</td> |
| 41 | + <td>SELECT usename FROM pg_user WHERE usesuper IS TRUE</td> |
| 42 | + </tr> |
| 43 | + <tr> |
| 44 | + <td>Current Database</td> |
| 45 | + <td>SELECT current_database()</td> |
| 46 | + </tr> |
| 47 | + <tr> |
| 48 | + <td>Databases</td> |
| 49 | + <td>SELECT datname FROM pg_database</td> |
| 50 | + </tr> |
| 51 | + <tr> |
| 52 | + <tr> |
| 53 | + <td>Tables</td> |
| 54 | + <td>SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN (‘r’,”) AND n.nspname NOT IN (‘pg_catalog’, ‘pg_toast’) AND pg_catalog.pg_table_is_visible(c.oid)</td> |
| 55 | + </tr> |
| 56 | + <tr> |
| 57 | + <td>Tables from Column Names</td> |
| 58 | + <td>SELECT c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace WHERE c.relkind IN (‘r’,”) AND n.nspname NOT IN (‘pg_catalog’, ‘pg_toast’) AND pg_catalog.pg_table_is_visible(c.oid)</td> |
| 59 | + </tr> |
| 60 | + <tr> |
| 61 | + <td>Columns</td> |
| 62 | + <td>SELECT relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A, pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND (A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT A.attisdropped) AND (N.nspname ILIKE ‘public’)</td> |
| 63 | + </tr> |
| 64 | + <tr> |
| 65 | + <td>Find Stored Procedures</td> |
| 66 | + <td> |
| 67 | + SELECT proname <br> |
| 68 | + FROM pg_catalog.pg_namespace n <br> |
| 69 | + JOIN pg_catalog.pg_proc p <br> |
| 70 | + ON pronamespace = n.oid <br> |
| 71 | + WHERE nspname = 'public'; <br> |
| 72 | + </td> |
| 73 | + </tr> |
| 74 | + <tr> |
| 75 | + <td>Comments</td> |
| 76 | + SELECT 1; –comment<Br> |
| 77 | + SELECT /*comment*/1;<br> |
| 78 | + </td> |
| 79 | + </tr> |
| 80 | + </tr> |
| 81 | + <tr> |
| 82 | + <td>Server Name</td> |
| 83 | + <td></td> |
| 84 | + </tr> |
| 85 | + <tr> |
| 86 | + <td>Host Name</td> |
| 87 | + <td>select inet_server_addr()</td> |
| 88 | + </tr> |
| 89 | + <tr> |
| 90 | + <tr> |
| 91 | + <td>Listening Port</td> |
| 92 | + <td>select inet_server_port();</td> |
| 93 | + </tr> |
| 94 | + <tr> |
| 95 | + <td>List Settings</td> |
| 96 | + <td>SELECT * FROM pg_settings;</td> |
| 97 | + </tr> |
| 98 | + </tbody> |
| 99 | +</table> |
0 commit comments