Assess database security posture and authorization boundaries

The skill is restricted to authorized use: it states explicitly that it is for educational purposes or authorized security assessments only, requires explicit written permission from the system owner, and treats misuse as illegal and strictly prohibited. Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target, it requires the user to state the exact target, confirm written authorization and scope, and explicitly confirm the shown commands - without that confirmation it stays read-only and offers defensive guidance only.

Within that gate, it covers unauthorized database access, weak credentials, misbound listeners (0.0.0.0), over-broad grants, dangerous server-side features (xp_cmdshell, COPY PROGRAM, user-defined functions), lateral movement from an application account to a DBA-level one, and NoSQL injection or Redis file-write techniques in an authorized environment. The workflow checks network exposure and TLS configuration, account roles and grantees, access control on sensitive tables, dangerous configuration flags (file_priv, xp_cmdshell, load_file), whether audit logging is enabled, and permissions on backups and snapshots. The toolchain pairs the database's official CLI for connection and enumeration, sqlmap for authorized injection verification, Nuclei for known-exposure templates, and the cloud provider's RDS console for configuration audit.

Use it for assessing database hardening and exposure within an approved scope, or checking authorization boundaries and risky server-side execution features. Never run it against production data stores without explicit written approval, and treat active exploitation paths like UDF or command execution as destructive-capable - simulate them first rather than running them directly.

Input is the authorized database target and confirmed scope. Output is findings distinguishing configuration issues from genuinely exploitable chains, covering exposure, permission, and dangerous-feature risks, with OS-command findings routed to attack-chain analysis and cloud-hosted database findings routed to cloud/Kubernetes security review.

Security assessors conducting an authorized database hardening review who need to separate real exploitable chains from configuration findings without touching production data.