Skip to content
HackIndex logo

HackIndex

RDS Database Enumeration

2 min read May 24, 2026

List DB Instances

┌──(kali㉿kali)-[~]
└─$ aws rds describe-db-instances --profile $PROFILE --region $REGION --query 'DBInstances[*].{ID:DBInstanceIdentifier,Engine:Engine,Version:EngineVersion,Public:PubliclyAccessible,Encrypted:StorageEncrypted,Endpoint:Endpoint.Address,Port:Endpoint.Port,Status:DBInstanceStatus}' --output table

Key fields: PubliclyAccessible and Endpoint.Address. A publicly accessible instance with a security group open to 0.0.0.0/0 is directly reachable.

Snapshots

List manual and automated snapshots:

┌──(kali㉿kali)-[~]
└─$ aws rds describe-db-snapshots --profile $PROFILE --region $REGION --query 'DBSnapshots[*].{ID:DBSnapshotIdentifier,DB:DBInstanceIdentifier,Engine:Engine,Status:Status,Encrypted:Encrypted,Public:SnapshotType}' --output table
┌──(kali㉿kali)-[~]
└─$ aws rds describe-db-snapshots --profile $PROFILE --region $REGION --include-public --query 'DBSnapshots[?SnapshotType==`public`]'

Public RDS snapshots can be restored by any AWS account. They frequently contain full database dumps with credentials and application data.

Cluster Snapshots (Aurora)

┌──(kali㉿kali)-[~]
└─$ aws rds describe-db-cluster-snapshots --profile $PROFILE --region $REGION --include-public --query 'DBClusterSnapshots[?SnapshotType==`public`]'

DB Subnet Groups

Shows which VPC subnets the RDS instance is deployed in:

┌──(kali㉿kali)-[~]
└─$ aws rds describe-db-subnet-groups --profile $PROFILE --region $REGION

Parameter Groups

Parameter groups store DB engine configuration. Some parameters expose attack surface:

┌──(kali㉿kali)-[~]
└─$ aws rds describe-db-parameters --db-parameter-group-name $PARAM_GROUP --profile $PROFILE --region $REGION

For MySQL/MariaDB, general_log and slow_query_log settings indicate whether query logging is active. log_output=FILE means logs go to the filesystem.

Master Credentials Location

RDS master passwords are not stored in the RDS API. They are typically in:

  • Secrets Manager (aws secretsmanager list-secrets)

  • SSM Parameter Store (aws ssm describe-parameters)

  • Environment variables of the application (Lambda, ECS, EC2 user data)

See Secrets Manager and SSM Parameter Store Enumeration.

Security Group Check

For each instance's VPC security group, check inbound rules:

┌──(kali㉿kali)-[~]
└─$ aws ec2 describe-security-groups --group-ids $SG_ID --profile $PROFILE --region $REGION --query 'SecurityGroups[*].IpPermissions'

Port 3306 (MySQL), 5432 (PostgreSQL), 1433 (MSSQL), 1521 (Oracle) open to 0.0.0.0/0 means direct internet access to the database.