Databases

Relational and Non-Relational databases are a valuable target for attackers, with sensitive information often stored within the database tables such as Personally Identifiable Information (PII) and credentials. There are also several vulnerabilities and misconfigurations that can be exploited by an attacker to gain remote shell access to the host running the platform, privilege escalation and malicious program execution.

Relational Databases

Structured Query Language (SQL) is a language specifically designed for managing structured data within relational database systems and is commonly used as backend storage for many software and web applications. See the post SQL Overview for more background information.

There are multiple relational database management systems (RDBMS), some of the most commonly encountered, their default ports and tool applicability are listed in the below table:

Service	Port	Nmap	MSF	Hydra	SQLmap	Other
MSSQL	1433-1434	X	X	X	X	Crackmapexec Impacket
MySQL/MariaDB	3306	X	X	X	X
Oracle	1521	X	X	X	X	Oscanner ODAT
PostgreSQL	5432	X	X	X	X

SQL Injection

See CAPEC 66 - SQL Injection for verbose information and steps involved in conducting a SQL Injection attack.

Non-Relational Databases

Non-Relational databases store data in a different format than Relational databases that rely on SQL. Non-Relational databases are often categorized as Not Only SQL (NoSQL) and are generally defined as a database that does not use tables, fields, and columns that structured data required. There are a few different categories of Non-Relational databases such as; Document, Key-Value, Graph, File Systems, etc.

As with the various RDBMS solutions, there are a number of Non-Relational systems, some of the most commonly encountered, their default ports and tool applicability are listed in the below table. Other solutions which aren't typically listed as NoSQL databases are added here also, such as Redis and Memcached which are memory storage solutions and Hadoop, NFS, AFP, and iSCSI which are file systems.

Service	Port	Nmap	MSF	Hydra	Other
AFP	548	X	X	X
Cassandra	9042	X	X
Hadoop HDFS	50070 50075 50090	X
Hadoop Mapreduce	50030 50060	X
Memcached	11211	X	X	X
MongoDB	27017	X	X	X
NFS	2049	X	X		NFSshell
Redis	6579	X	X	X
iSCSI	3260	X			Open-iSCSI iSCSIadm