I tried using the following command:
nmap -p 5432 -v --script pgsql-brute myhost
But I got no output related to the pgsql script nor the dbms version.
I tried using the following command:
nmap -p 5432 -v --script pgsql-brute myhost
But I got no output related to the pgsql script nor the dbms version.
The pgsql-brute script performs password guessing (brute-forcing) against PostgreSQL databases. It does not retrieve any version information or display anything but successfully-guessed usernames and passwords.
A more useful command for getting information from a PostgreSQL database would be:
nmap -p 5432 -sV myhost
This performs service and application version detection on the database, and results in output like:
PORT STATE SERVICE VERSION
5432/tcp open postgresql PostgreSQL DB 9.1.12 - 9.1.14
This is based on a line number in an error response to a probe to that port, and can usually narrow down the version to one of a handful of minor versions.
In nmap, you should know the following:
When you want to run a protocol-specific NSE script, such as pgsql-brute (or the generic brute
NSE script), nmap will need the version information to match the port or be able to detect it, i.e.,
nmap -v --script brute -sV -p 5432 <ip>
or nmap can skip version detection if the +
character is utilized -- thus forcing the script to run, e.g.,
nmap -v --script +pgsql-brute -p 5432 <ip>