Database Security Assessment

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read precedent-pentest; Destructive statements are prohibited in production databases unless explicitly permitted

2. NOW

   : Clearly document the scope including instances, account permissions, and whether write/delete operations are allowed

3. NEXT

   : Client tool paths

4. ACT

   : Exposure Surface → Authentication → Authorization → Configuration → Exploit Chain Validation (Security)

Application Scenarios

• Unauthorized access/weak passwords/incorrect binding to 0.0.0.0 for databases
• Excessive permissions, dangerous functions (xp_cmdshell, COPY PROGRAM, UDF)
• Lateral movement: From application accounts to DBA
• NoSQL injection and Redis file writing, etc. (authorized environments)

Workflow

□ Network exposure and TLS
□ Account roles and grantee
□ Sensitive table access control
□ Dangerous configurations: file_priv, xp_cmdshell, load_file
□ Whether audit logs are enabled
□ Backup and snapshot permissions

Toolchain

References

• references/db-misconfig-checklist.md

• ../pentest-tools/

  ../cloud-k8s/

Routing Context

Task Completion Self-Check

• Have unauthorized write/delete operations been avoided?
• Have configuration issues and exploitable chains been distinguished?
• Checklist completed?