How secure is your database? Hacking Postgres with Hathi
summary
A free MIT‑licensed tool called Hathi automates database dictionary attacks against Postgres (also MySQL and SQL Server): install with pip install hathi on Python 3.8, then supply host, optional --passwords, --multiple, --no-ssl and --json flags. Older Postgres versions leak whether a username or password is wrong, enabling username enumeration; Hathi uses a ~6,000-entry DB‑specific wordlist, tries ~80–120 logins/sec (Postgres has no throttling by default), and reports successful credential pairs. Azure managed Postgres adds rate limiting.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:21Network security in Postgres
- 3:09Typical authentication workflow in Postgres
- 9:16Can I guess your login?
- 11:47Can I guess your password?
- 12:40Using Hathi to hack Postgres
- 13:54Installing & running Hathi
- 14:39Demo
- 21:22How can we solve the network security problem?
- 24:51Q&A with Anthony & Aaron
related talks
22mPostgreSQL Threats and Attacks in the Wild
44mWho's managing the credentials for your database?
45mSecurity Attacks on PostgreSQL
35mSecuring PostgreSQL From External Attack
54mConfiguration and Authentication
27mWho's managing the credential for your data infrastructure?
50mSecuring PostgreSQL From External Attack
07mAll about Postgres security