database-security

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Database Security Assessment

ACTION REQUIRED（读完后立刻执行）

NOW: 读取 precedent-pentest；生产库禁止破坏性语句 unless 明确允许
NOW: scope 写清实例、账号权限、是否允许写/删
NEXT: 客户端工具路径
ACT: 暴露面 → 认证 → 授权 → 配置 → 利用链验证（安全）

适用场景

数据库未授权/弱口令/错误绑定 0.0.0.0
权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF）
横向：从应用账号到 DBA
NoSQL 注入与 Redis 写文件等（授权环境）

工作流

□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限

工具链

工具	用途
官方 CLI	连接与枚举
sqlmap	注入验证（授权）
nuclei	已知暴露模板
云 RDS 控制台审计	配置

参考

references/db-misconfig-checklist.md
../pentest-tools/ ../cloud-k8s/

路由上下文

上游: MASTER R35
下游: 获 OS 命令 → attack-chain；云托管 → cloud-k8s

任务完成自检

是否避免未授权写删？
是否区分配置问题与可利用链？
Checklist？

Repository: zhaoxuya520/reverse-skill
Path: skills/database-security/SKILL.md
Commit: 6aa1362

Last updated: 7 days ago
First committed: 21 days ago

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.