database-security

Checks databases for leaks and access problems to make sure your data stays private and safe.

Installation

Run `npx skills add "https://github.com/zhaoxuya520/reverse-skill" --skill "database-security"` to install this skill, then follow its SKILL.md instructions for my next request.

Paste this into Claude Code, Cursor, or any agent that can run commands.

What this skill does

What it does: - Checks if databases like PostgreSQL, MySQL, SQL Server, MongoDB, and Redis are properly protected - Tests if anyone can access them without a password or with weak passwords - Looks for dangerous features that could let attackers run commands or steal data - Checks if user accounts have too much power - Reviews settings that might expose sensitive information When to use it: - A database is connected to the internet without protection - You suspect someone could log in with a weak or default password - You want to make sure database users only have the permissions they need - You need to check if dangerous features like file access or command execution are turned on - You want to verify that database backups and settings are secure

SKILL.mdShow the author's original SKILL.md (not in English)

---
name: database-security
description: Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.
---

# Database Security Assessment

## ACTION REQUIRED（读完后立刻执行）

1. `NOW`: 读取 precedent-pentest；**生产库禁止破坏性语句** unless 明确允许
2. `NOW`: scope 写清实例、账号权限、是否允许写/删
3. `NEXT`: 客户端工具路径
4. `ACT`: 暴露面 → 认证 → 授权 → 配置 → 利用链验证（安全）

## 适用场景

- 数据库未授权/弱口令/错误绑定 0.0.0.0
- 权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF）
- 横向：从应用账号到 DBA
- NoSQL 注入与 Redis 写文件等（授权环境）

## 工作流

```text
□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限
```

## 工具链

| 工具 | 用途 |
|------|------|
| 官方 CLI | 连接与枚举 |
| sqlmap | 注入验证（授权） |
| nuclei | 已知暴露模板 |
| 云 RDS 控制台审计 | 配置 |

## 参考

- `references/db-misconfig-checklist.md`
- `../pentest-tools/` `../cloud-k8s/`

## 路由上下文

**上游**: MASTER R35  
**下游**: 获 OS 命令 → attack-chain；云托管 → cloud-k8s

## 任务完成自检

- [ ] 是否避免未授权写删？
- [ ] 是否区分配置问题与可利用链？
- [ ] Checklist？

Ships with 1 supporting file:

references/db-misconfig-checklist.md

Mirrored from the author's public source. Install counts from the open skills registry.