Enumeration

PostgreSQL enumeration maps the database landscape once you have a connection. Start with version detection via Nmap or a direct SELECT version() query, then list databases with \l or pg_database. Role enumeration through pg_roles reveals superusers, login-capable accounts, and role memberships that hint at privilege escalation paths.

Schema inspection with \dt, information_schema, and pg_catalog exposes table structures, column types, and foreign key relationships across every accessible database. Extension discovery (pg_available_extensions, pg_extension) shows what is loaded, since extensions like dblink, pg_stat_statements, or file_fdw expand your attack surface significantly.

Check pg_settings for runtime configuration and pg_hba_file_rules (PostgreSQL 10+) if accessible. These expose authentication rules, listen addresses, and whether SSL is enforced.