# PostgreSQL

> PostgreSQL attack reference covering version and role enumeration, weak cred discovery, RCE via COPY TO PROGRAM and UDFs, privesc, lateral movement, persistence, and data exfiltration

- **URL:** https://hackindex.io/services/postgresql
- **Type:** Service
- **Default ports:** 5432
- **Tags:** postgresql, database, sql, linux, rdbms
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

PostgreSQL runs on **TCP port 5432** and is a widely used open-source relational database. Nmap identifies it as `postgresql`. It is common in web application stacks, data warehouses, and cloud environments.

Default installations may allow local trust authentication or have weak passwords on the `postgres` superuser account. PostgreSQL's `COPY` command can read and write files on the server. The `pg_execute_server_program` role and user-defined functions in C or PL/Python provide paths to OS command execution when sufficient privileges are available.

Test credentials with `psql`, `hydra`, or `crackmapexec`. After authentication, check the current user's role and privileges, list databases and tables, and look for sensitive data. Test file read/write capabilities and check for installed extensions that enable command execution.

## Phases

- [Enumeration](https://hackindex.io/services/postgresql/enumeration.md): Enumerate PostgreSQL version, DBs, schemas, roles, and extensions (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/postgresql/vulnerability-discovery.md): Guides for finding PostgreSQL auth flaws, weak creds, and misconfigs (4 guides)
- [Exploitation](https://hackindex.io/services/postgresql/exploitation.md): RCE via COPY TO PROGRAM, UDF, file read, and privesc methods (1 guides)