<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: performing-database-security-testing
subdomain: security-testing
title: "Performing Database Security Testing"
description: "Techniques and methodologies for performing database security testing"
tags:
  - database-security
  - SQL-injection
  - access-control
  - encryption
  - data-exposure
metadata:
  mitre-attack: ["T1190"]
---

# Performing Database Security Testing

> Conduct security assessments of database systems including access controls, encryption, injection vulnerabilities, and data exposure risks.

## Overview

Database security testing evaluates the security posture of relational and NoSQL database systems. This technique covers authentication testing, privilege escalation, injection vulnerabilities, encryption verification, and data exposure assessment.

## Core Concepts

- **Authentication testing**: Default credentials, brute force, authentication bypass
- **Privilege escalation**: Excessive grants, role misconfigurations, stored procedure abuse
- **Injection testing**: SQL/NoSQL injection, second-order injection, blind injection
- **Encryption verification**: TDE, column-level encryption, TLS for connections
- **Data exposure**: Sensitive data discovery, masking validation, backup security

## Workflow

1. Enumerate database instances, versions, and network exposure
2. Test authentication mechanisms and default credentials
3. Map database users, roles, and privilege assignments
4. Test for privilege escalation paths
5. Assess SQL/NoSQL injection in application queries
6. Verify encryption at rest and in transit
7. Discover sensitive data and validate masking controls
8. Test audit logging configuration and completeness
9. Assess backup security and access controls
10. Document findings with remediation priorities

## Implementation

```python
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional


class DBType(Enum):
    POSTGRESQL = "postgresql"
    MYSQL = "mysql"
    MSSQL = "mssql"
    MONGODB = "mongodb"
    REDIS = "redis"


@dataclass
class DBSecurityFinding:
    title: str
    severity: str
    category: str
    database: str
    detail: str
    remediation: str
    cwe: str | None = None


class DatabaseSecurityTester:
    """Database security testing framework."""

    def __init__(self) -> None:
        self.targets: list[dict] = []
        self.findings: list[DBSecurityFinding] = []

    def add_target(self, host: str, port: int, db_type: DBType, name: str) -> None:
        self.targets.append({"host": host, "port": port, "type": db_type.value, "name": name})

    def add_finding(self, finding: DBSecurityFinding) -> None:
        self.findings.append(finding)

    def findings_by_severity(self, severity: str) -> list[DBSecurityFinding]:
        return [f for f in self.findings if f.severity == severity]

    def findings_by_category(self, category: str) -> list[DBSecurityFinding]:
        return [f for f in self.findings if f.category == category]

    def test_summary(self) -> dict:
        return {
            "databases_tested": len(self.targets),
            "total_findings": len(self.findings),
            "critical": len(self.findings_by_severity("critical")),
            "high": len(self.findings_by_severity("high")),
            "medium": len(self.findings_by_severity("medium")),
            "low": len(self.findings_by_severity("low")),
            "categories": list({f.category for f in self.findings}),
        }
```

## Best Practices

- Test with both authenticated and unauthenticated access levels
- Check for default credentials on every database instance—they persist in production
- Test injection with parameterized payloads, not just basic 'OR 1=1'
- Verify TLS is enforced, not just available—check for downgrade attacks
- Assess row-level security and column-level access controls
- Test backup files for unencrypted sensitive data—backups are a common leak vector

## Detection

```yaml
title: Database Security Testing Detection
id: d4a3d4be-0220-4408-8b02-5587952e70da
status: experimental
description: Detects suspicious activity related to performing database security testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*database*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Database Security Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Related Techniques

- [Performing Thick Client Security Testing](../performing-thick-client-security-testing/SKILL.md)
- [Building Security Testing Methodology](../building-security-testing-methodology/SKILL.md)
