Auger — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Auger is a database security auditor that performs comprehensive authenticated security audits of network-accessible databases. It supports 15 database types: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle, MongoDB, Redis, Cassandra, Elasticsearch, CouchDB, InfluxDB, Neo4j, Memcached, and AWS managed databases (RDS, DynamoDB, Redshift). Each database type has a dedicated auditor class that implements type-specific security checks using the database's native client library and query language — Auger does not shell out to command-line tools.

The audit pipeline operates in structured phases:

Phase 1: Connectivity — TCP probe and TLS handshake analysis. Checks for weak TLS versions (TLS 1.0/1.1), weak cipher suites, self-signed certificates, and expired certificates.
Phase 2: Database-Specific Audit — Runs the full battery of the type-specific auditor: version detection and EOL checking, authentication and password policies, user privileges and role assignments, anonymous/unauthenticated access, default credential testing, encryption at rest/in transit, logging and audit configuration, bind address restrictions, and database-specific dangerous features.
Sensitive Data Scanning — Enumerates schema columns across all accessible databases and flags columns with sensitive-pattern names (SSN, credit card, password, PII, PHI, PCI-related fields) using regex matching.
Schema Enumeration — Exports the full database schema (tables, columns, types, row counts) to db_schema.json for offline analysis.

Auger is strictly read-only — it does NOT modify the database in any way. It connects using the provided credentials and issues only read queries (SELECT, SHOW, information_schema lookups) to inspect configuration state. For AWS managed databases, it uses boto3 to audit the control-plane surface (encryption, backups, public accessibility, IAM auth) without connecting to the database engine itself.

Findings are emitted in the Fracture-compatible universal finding schema with catalogue IDs (DB-NNN prefix), OWASP 2021 compliance mappings, and actionable remediation guidance enriched from catalogue/auger_catalogue.json. When run under Crucible (CRUCIBLE_MANAGED=1), Auger emits structured protocol tokens (__CRUCIBLE_LOG__, __CRUCIBLE_ERR__, __CRUCIBLE_STATUS__, __CRUCIBLE_PROMPT__, __CRUCIBLE_ACTION_ITEM__). Checkpoint/resume support persists completed phases so an interrupted audit can be resumed without repeating checks.

Phase Pipeline

Phase 1 — Target Discovery
Phase 2 — Network Phase
Phase 3 — Service Enumeration
Phase 4 — Vulnerability Scanning
Phase 5 — Credential Auditing
Phase 6 — Findings Generation

Security

Auger is designed as a read-only auditor that never modifies the target database. All checks use SELECT queries, SHOW commands, information_schema lookups, or equivalent read-only operations for each database type. For NoSQL databases (MongoDB, Redis, Elasticsearch, CouchDB, InfluxDB, Neo4j, Memcached), checks use read-only admin commands (e.g., CONFIG GET, db.adminCommand, REST API GETs). Default credential testing includes a configurable delay between attempts (--cred-delay, default 0.5s) to avoid account lockout. When running under Crucible, Auger prompts for confirmation (__CRUCIBLE_PROMPT__) before default credential checks. The tool never stores credentials in output files — only the authentication success/failure status is recorded.

Features

AWS Cloud

DynamoDB Auditor

Control-plane audit via boto3: table inventory, encryption-at-rest status (AWS-owned vs. customer-managed KMS), point-in-time recovery, DynamoDB Streams exposure, deletion protection, and resource policy analysis (Principal=* detection).

RDS Auditor

Control-plane audit via boto3: encryption-at-rest, public accessibility, backup retention policy, IAM database authentication, Performance Insights exposure, parameter group drift, Enhanced Monitoring, auto-minor-version-upgrade, Multi-AZ deployment, and CloudWatch log exports.

Redshift Support

Redshift uses the PostgreSQL wire protocol; Auger generates an IAM auth token via boto3 when --auth-type=iam, then audits via the PostgreSQL auditor with schema enumeration.

Compliance

EOL Version Detection

Checks database version against a comprehensive end-of-life table covering MySQL (5.0-5.7), MariaDB (5.5-10.5), PostgreSQL (9.0-11), MSSQL (2005-2014), Oracle (9i-12.1), MongoDB (2.4-4.0), Redis (2.0-4.0), Elasticsearch (1.0-6.8), and Cassandra (1.0-2.2).

Known CVE Matching

Matches detected database versions against a built-in CVE database covering MySQL, PostgreSQL, MSSQL, MongoDB, Redis, Elasticsearch, and Cassandra. Includes CVSS scores and descriptions for critical CVEs like CVE-2016-6662 (MySQL RCE), CVE-2022-0543 (Redis Lua sandbox escape), and CVE-2021-44521 (Cassandra UDF RCE).

Default Credential Testing

Tests common default username/password combinations for each database type (MySQL: root/root, root/empty; PostgreSQL: postgres/postgres; MSSQL: sa/sa; Oracle: sys/change_on_install, scott/tiger; MongoDB: admin/admin; Redis: empty/foobared; Cassandra: cassandra/cassandra; and more). Configurable delay between attempts.

Multi-Framework Compliance Mapping

Findings include OWASP 2021, OWASP ASVS, ISO 27001, PCI DSS, HIPAA, and NIST 800-53 mappings from the catalogue, stored as list-valued fields for v1.1 schema compliance.

Data

Sensitive Column Scanning

Scans all accessible database schemas for columns with names matching sensitive-data patterns: SSN, credit card, CVV, password, API key, date of birth, phone, email, health/medical/patient data, salary, bank account, IBAN, and SWIFT codes.

Schema Enumeration

Exports full database schema (tables, columns, data types, row counts) to db_schema.json for offline analysis. Supported for MySQL, PostgreSQL, MSSQL, Oracle, and MongoDB.

Database Support

MySQL / MariaDB Auditor

18 security checks: version/EOL detection, anonymous users, test database exposure, LOCAL INFILE, secure_file_priv, remote root access, wildcard hosts, password policy, general log exposure, SSL/TLS configuration, encryption at rest, audit log plugin, symbolic links, bind address, user privilege analysis, SQL mode, error log, and default credential testing.

PostgreSQL Auditor

15 security checks: version/EOL detection, SSL configuration, password encryption method, superuser enumeration, public schema permissions, row-level security, logging configuration, dangerous extensions, default credentials, COPY PROGRAM, listen addresses, pgcrypto availability, pg_audit extension, and data directory permissions.

MSSQL Auditor

14 security checks: xp_cmdshell status, SA account security, CLR integration, OLE automation, linked servers, BUILTIN\Administrators access, password policy enforcement, Transparent Data Encryption (TDE), ad hoc distributed queries, database mail, default credentials, Always Encrypted configuration, and audit destination configuration.

Oracle Auditor

10 security checks: version/patch detection, default tablespace passwords, public grants on sensitive packages (UTL_FILE, DBMS_LOB, UTL_HTTP, UTL_TCP, UTL_SMTP, DBMS_SQL), remote OS authentication, UTL_FILE directory, audit trail configuration, excessive privileges, legacy password hashes, and Oracle Label Security (OLS).

MongoDB Auditor

9 security checks: version/EOL detection, authentication enforcement, JavaScript execution control, TLS configuration, user role analysis, bind IP restrictions, encryption at rest, oplog exposure, and default credential testing.

Redis Auditor

8 security checks: version/EOL detection, no-authentication access, protected mode status, dangerous command availability (FLUSHDB, FLUSHALL, DEBUG, CONFIG, EVAL, SHUTDOWN, BGSAVE, BGREWRITEAOF), bind address, TLS support, ACL configuration, and default credentials.

Cassandra Auditor

5 security checks: version/EOL detection, authentication enforcement, default credential testing (cassandra/cassandra), TLS configuration (client and inter-node), and superuser enumeration.

Elasticsearch Auditor

6 security checks: version/EOL detection, unauthenticated access, cluster info exposure, index enumeration, X-Pack security settings, and default credential testing.

CouchDB Auditor

4 security checks: admin party mode detection (no admin account), unauthenticated API access, cluster configuration exposure, and default credential testing.

InfluxDB Auditor

4 security checks: initial setup completion, unauthenticated access, bucket enumeration without credentials, and default credential testing.

Neo4j Auditor

4 security checks: browser config endpoint exposure (authentication settings, default database, JMX/GC/memory metrics), default credential testing, and dangerous procedure access (apoc.load.shell, dbms.security).

Memcached Auditor

3 security checks: SASL authentication status, runtime statistics exposure (PID, memory, connections), and cached data key enumeration without authentication.

Network

TLS / Certificate Analysis

Pre-connection TLS handshake analysis: weak TLS version detection (TLS 1.0/1.1/SSLv2/SSLv3), weak cipher suite identification (RC4, DES, 3DES, NULL, ANON), self-signed certificate detection, and expired certificate detection.

TCP Banner Grab

Raw TCP banner probe for service identification and version fingerprinting before database-specific connection.

JDBC Connection String Parsing

Parses JDBC URLs (mysql, postgresql, sqlserver, oracle, mongodb, redshift) to extract db_type, host, port, database, and connection parameters.

Output

Evidence File Generation

Every finding that includes a query or output generates a triplet of evidence files: a result text file, a .log transcript (target, finding, risk, datetime, query, result file reference), both stored under evidence/<db_type>/ with run-dir-relative paths in the finding's output_file field.

Validation-Required Flagging

Findings that require manual verification are flagged with validation_required=true and validation_notes, and assigned confidence='Tentative' (vs. 'Firm' for fully automated detections).

CVE Update from NVD

Optional --update-cves flag fetches latest CVEs from the National Vulnerability Database before the audit to ensure the version-to-CVE matching is current.

Resilience

Checkpoint / Resume

Completed phases are saved to checkpoint.json. On resume (CRUCIBLE_RESUME=1), previously completed checks are skipped.

Pause / Resume Support

Integrates with Crucible's pause manager (pr0t31n_pause) for graceful interruption between audit phases.

Use Cases

Database Security Assessment

Comprehensive authenticated security audit of database servers during a penetration test, covering authentication, encryption, access control, logging, and configuration hardening across 15+ database types.

Compliance Database Audit

Evaluate database configurations against PCI DSS, HIPAA, SOC 2, ISO 27001, and NIST 800-53 requirements. Findings include multi-framework compliance mappings for direct reporting.

Medical Device Database Review

Audit the database backend of medical device systems for security hardening, checking for default credentials, unencrypted connections, excessive privileges, sensitive data exposure (PHI columns), and missing audit trails.

Cloud Database Assessment

Audit AWS managed databases (RDS, DynamoDB, Redshift) via boto3 for encryption at rest, public accessibility, IAM authentication, backup retention, deletion protection, and resource policy misconfigurations.

Multi-Database Environment Audit

Systematically audit all database servers in a heterogeneous environment: MySQL for web apps, MongoDB for document stores, Redis for caching, PostgreSQL for analytics, Elasticsearch for search, each with type-specific security checks.

Default Credential Sweep

Test all database servers in scope for default credentials with configurable delay (--cred-delay) to avoid account lockout, flagging any that succeed as critical findings requiring immediate remediation.

Sensitive Data Discovery

Enumerate all accessible database schemas and flag columns whose names match PII/PHI/PCI patterns (SSN, credit card, password, health data), producing an inventory for data classification efforts.

CLI Reference

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

PyMySQL

MySQL/MariaDB connection for security checks (Python library, not subprocess).

pymysql.connect(host=<ip>, port=<port>, user=<user>, password=<pass>, database='information_schema')

psycopg2

PostgreSQL connection for privilege and config auditing.

psycopg2.connect(host=<ip>, port=<port>, user=<user>, password=<pass>, dbname='postgres')

Finding Nomenclature

Auger findings use the DB- prefix in catalogue IDs, organized by database type and finding category:

DB-001 through DB-019 — Universal database findings (EOL version, weak TLS, self-signed certificate, weak ciphers, sensitive data columns)
DB-051 through DB-057 — MySQL/MariaDB-specific checks (anonymous users, test DB, LOCAL INFILE, remote root, password policy, general log, audit log)
DB-100 through DB-110 — PostgreSQL-specific checks (SSL, encryption method, superusers, public schema, row security, logging, extensions, COPY PROGRAM, pgcrypto, pg_audit, data directory)
DB-151 through DB-157 — MSSQL-specific checks (xp_cmdshell, SA account, CLR, OLE automation, linked servers, BUILTIN\Administrators, TDE, audit)
DB-200 through DB-208 — MongoDB-specific checks (auth, JavaScript, TLS, users, bind IP, encryption, oplog)
DB-300 through DB-303, DB-350 through DB-352 — Redis and Cassandra checks
DB-400 through DB-402 — Elasticsearch checks
DB-420 through DB-451 — CouchDB, InfluxDB, Neo4j, and Memcached checks
DB-RDS-xxx — AWS RDS/Aurora control-plane checks (encryption, public access, backups, IAM, monitoring)
DB-DDB-xxx — AWS DynamoDB control-plane checks (encryption, PITR, streams, deletion protection, resource policies)
DB-MS-xxx — MSSQL Always Encrypted and audit-specific checks
DB-PG-xxx — PostgreSQL extended checks (pgcrypto, pg_audit, data directory)
DB-MDB-xxx — MongoDB extended checks (oplog, encryption at rest)

Each finding carries:

Risk Level — CRITICAL (default credentials, disabled authentication, RCE vectors), HIGH (missing encryption, excessive privileges, disabled audit logging), MEDIUM (configuration gaps, weak TLS), LOW/INFO (best-practice recommendations)
Compliance Mappings — OWASP 2021, ISO 27001, PCI DSS 4.0, NIST 800-53, HIPAA references from the catalogue
Confidence — 'Firm' for fully automated verifiable detections, 'Tentative' for findings flagged as validation_required=true
CVE References — Matched CVEs with CVSS scores from the built-in vulnerability database

Action Items

Auger emits action items as __CRUCIBLE_ACTION_ITEM__ protocol tokens and persists them to action_items.json in the output directory. Each action item includes an ID, type, recommended tool, target (host:port), priority, and description. The recommended tools are:

ExploitDB — When a matched CVE has known public exploits (triggered by keyword matching in CVE descriptions)
Metasploit — When a matched CVE has a known Metasploit module (e.g., xp_cmdshell exploitation, Redis Lua sandbox escape)
Manual Verification — When a finding requires human judgment to determine if the configuration is intentional or represents a true vulnerability

Common action item scenarios:

CVE exploitation follow-up — When a database version matches a critical CVE with known exploits, an action item recommends verification via ExploitDB or Metasploit
Default credential verification — Confirming whether identified default credentials are used in production vs. test environments
Stored procedure review — Verifying whether flagged dangerous stored procedures (xp_cmdshell, CLR assemblies, OLE automation) are legitimately required by applications
Privilege review — Reviewing specific user privileges that appear excessive but may be justified by application requirements
Encryption key management — Validating that encryption key management meets organisational requirements when TDE or KMS is misconfigured
Memcached data key review — Manual inspection of enumerated cache key names for PII, session tokens, or API keys

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`checkpoint.json`	JSON	Resumable scan checkpoint

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Auger && python3 auger.py [OPTIONS]` Run directly with command-line arguments.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Used By

Crucible (manages)
Prometheus (reports)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
PyMySQL	Inada Naoki / PyMySQL contributors	python	https://github.com/PyMySQL/PyMySQL
psycopg2	Federico Di Gregorio / Daniele Varrazzo	python	https://github.com/psycopg/psycopg2
pymssql	pymssql contributors	python	https://github.com/pymssql/pymssql
oracledb	Oracle Corporation	python	https://github.com/oracle/python-oracledb
pymongo	MongoDB, Inc.	python	https://github.com/mongodb/mongo-python-driver
redis-py	Redis, Inc. / Andy McCurdy	python	https://github.com/redis/redis-py
cassandra-driver	DataStax	python	https://github.com/datastax/python-driver
elasticsearch-py	Elastic	python	https://github.com/elastic/elasticsearch-py
influxdb-client	InfluxData	python	https://github.com/influxdata/influxdb-client-python
neo4j (Python driver)	Neo4j, Inc.	python	https://github.com/neo4j/neo4j-python-driver
boto3	Amazon Web Services	python	https://github.com/boto/boto3

Metadata

Name	Auger
Category	Analysis
Version	1.11.1
Install Path	`/opt/pr0t31n/Auger`
Main File	`auger.py`
GitHub	https://github.com/pr0t31n/Auger.git