mcpField
D
database-security

database-security

github.com/zhaoxuya520Security43.7k1.1k installsUpdated 5w ago
Repository

About database-security

database-security is a skill for authorized database security assessments, intended for testers. It organizes checks around exposure, authentication, authorization, and configuration, and warns against destructive statements in production without explicit approval.

Key features

  1. 01Check network exposure and TLS
  2. 02Review account roles and sensitive-table access
  3. 03Identify risky settings and functions
  4. 04Check audit logging and backup permissions

Use cases

  1. 01Investigate unauthorized exposure or weak passwords
  2. 02Assess privilege paths from app accounts to DBA
  3. 03Review risky settings and file-access capabilities
  4. 04Test NoSQL injection within authorized scope

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/zhaoxuya520/reverse-skill --skill database-security

After installing, type/database-securityin Claude Code to confirm it loaded.

Bundled filesreferences/db-misconfig-checklist.md

Details

From the project README

Database Security Assessment

ACTION REQUIRED（读完后立刻执行）

  1. NOW: 读取 precedent-pentest；生产库禁止破坏性语句 unless 明确允许
  2. NOW: scope 写清实例、账号权限、是否允许写/删
  3. NEXT: 客户端工具路径
  4. ACT: 暴露面 → 认证 → 授权 → 配置 → 利用链验证（安全）

适用场景

  • 数据库未授权/弱口令/错误绑定 0.0.0.0
  • 权限过大、危险功能（xp_cmdshell、COPY PROGRAM、UDF）
  • 横向：从应用账号到 DBA
  • NoSQL 注入与 Redis 写文件等（授权环境）

工作流

□ 网络暴露与 TLS
□ 账号角色与 grantee
□ 敏感表访问控制
□ 危险配置：file_priv、xp_cmdshell、load_file
□ 审计日志是否开启
□ 备份与快照权限

工具链

工具用途
官方 CLI连接与枚举
sqlmap注入验证（授权）
nuclei已知暴露模板
云 RDS 控制台审计配置

参考

  • references/db-misconfig-checklist.md
  • ../pentest-tools/ ../cloud-k8s/

路由上下文

上游: MASTER R35
下游: 获 OS 命令 → attack-chain；云托管 → cloud-k8s

任务完成自检

  • 是否避免未授权写删？
  • 是否区分配置问题与可利用链？
  • Checklist？

Comments

Markdown supported