Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/m8sec/enumdb
Relational database brute force and post exploitation tool for MySQL and MSSQL
https://github.com/m8sec/enumdb
brute-force database enumeration mssql mysql pentest-tool pentesting post-exploitation python3
Last synced: about 6 hours ago
JSON representation
Relational database brute force and post exploitation tool for MySQL and MSSQL
- Host: GitHub
- URL: https://github.com/m8sec/enumdb
- Owner: m8sec
- License: gpl-3.0
- Created: 2018-01-19T19:00:25.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2024-06-19T14:31:03.000Z (5 months ago)
- Last Synced: 2024-10-30T05:57:48.420Z (14 days ago)
- Topics: brute-force, database, enumeration, mssql, mysql, pentest-tool, pentesting, post-exploitation, python3
- Language: Python
- Homepage:
- Size: 70.3 KB
- Stars: 216
- Watchers: 19
- Forks: 64
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project
README
# enumdb
Enumdb is a relational database brute force and post exploitation tool for MySQL and MSSQL. When provided a list of usernames and/or passwords, it will cycle through each host looking for valid credentials. By default, enumdb will use newly discovered credentials to automatically search for sensitive data fields via keyword searches on table or column names. This information can then be extracted and reported to a .csv or .xlsx output file.
**Recent Additions:**
* Ability to spawn simulated shell on target, execute edb or custom SQL queries.
* Added threading during standard enumeration and brute force for faster results.
* No report by default, ```-r csv``` or ```-r xlsx``` required for data extraction.
* Failed login attempts will not be shown by default (```-v``` required).
*Number of rows extracted, blacklisted databases & tables, and keywords searches can all be modified at: ```enumdb/config.py```.*
## Installation
Enumdb was designed and tested using Python3 on Debian based Linux systems (kali). However, the tool is also compatible with Python2.7, and on other Linux distributions.
```bash
git clone https://github.com/m8r0wn/enumdb
cd enumdb
python3 setup.py install
``````
## Usage
* Connect to a MySQL database and search for keywords in table names (no report)
```enumdb -u root -p 'password123' -t mysql 10.11.1.30```
* Connect to a MSSQL database using domain credentials, search for data using keywords in column names, and extract to a .xlsx report:
```enumdb -u 'domain\\user' -p Winter2018! -t mssql -columns -report xlsx 10.11.1.30```
* Brute force multiple MySQL servers looking for default credentials (no data or table enumeration)
```enumdb -u root -p '' -t mysql --brute 10.11.1.0-30```
* Brute force MSSQL sa account login. Once valid credentials are found, enumerate data by table name writing output to a .csv report:
```enumdb -u sa -P passwords.txt -t mssql -columns -report xlsx 192.168.10.10```
* Spawn an SQL shell on the system:
```enumdb -u sa -P 'P@ssword1' -t mssql --shell 192.168.10.10```
## All Options
```html
optional arguments:
-h, --help show this help message and exit
-T MAX_THREADS Max threads (Default: 10)
-v Verbose output
Connection:
-port PORT Specify non-standard port
-t {mysql,mssql} Database type
target Target database server(s) [Positional]
Authentication:
-u USERS Single username
-U USERS Users.txt file
-p PASSWORDS Single password
-P PASSWORDS Password.txt file
Enumeration:
-c, --columns Search for key words in column names (Default: table names)
-r {none,csv,xlsx} Extract data and create output report
Additional Actions:
--brute Brute force only (No DB Enumeration)
--shell Launch SQL Shell
```
## Shell Commands
```
enumdb#> help
...
edb_databases - list all databases
edb_tables [DB] - list tables in DB
edb_columns [table].[DB] - list columns in table
edb_dump [table].[DB] [#rows] - Get data from table
[SQL Query] - Execute raw SQL query
```
## Troubleshooting
If experiencing issues with [MySQLdb](https://github.com/PyMySQL/mysqlclient-python), additional MySQL development resources may be required:
* Debian / Ubuntu:
```
sudo apt-get install python3-dev default-libmysqlclient-dev build-essential
```
* Red Hat / CentOS:
```
sudo yum install python3-devel mysql-devel
```