fix(js): incorrect postgres exec call signature (#6731)

Make sure postgres Exec/ExecContext are invoked with the correct
argument order, preventing context from being passed as the query.

* fixing pg syntax

* adding test
This commit is contained in:
Mzack9999
2025-12-24 00:20:50 +04:00
committed by GitHub
parent 3fdc06bce3
commit 5d79201299
3 changed files with 110 additions and 10 deletions

View File

@@ -0,0 +1,47 @@
id: postgres-pass-brute
info:
name: PostgreSQL Password Bruteforce
author: pdteam
severity: high
description: |
This template bruteforces passwords for protected PostgreSQL instances.
If PostgreSQL is not protected with password, it is also matched.
metadata:
shodan-query: product:"PostgreSQL"
tags: js,network,postgresql,authentication
javascript:
- pre-condition: |
isPortOpen(Host,Port)
code: |
const postgres = require('nuclei/postgres');
const client = new postgres.PGClient;
success = client.Connect(Host, Port, User, Pass);
args:
Host: "{{Host}}"
Port: "5432"
User: "{{usernames}}"
Pass: "{{passwords}}"
attack: clusterbomb
payloads:
usernames:
- postgres
- admin
- root
passwords:
- ""
- postgres
- password
- admin
- root
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "success == true"