Patator PostgreSQL vs MySQL Authentication Modules: Key Differences and Applications

Patator's PostgreSQL (Pgsql_login) and MySQL (MySQL_login) modules differ primarily in their Python drivers, SSL support capabilities, and database targeting options, with PostgreSQL offering explicit SSL modes and database selection while MySQL provides server version fingerprinting upon successful authentication.

The lanjelot/patator repository includes specialized brute-force authentication modules for both PostgreSQL and MySQL servers within its comprehensive penetration testing framework. While both modules inherit from Response_Base and share Patator's common timing and error-handling infrastructure, their implementations vary significantly in connection handling, parameter support, and response parsing.

Technical Implementation Differences

Python Driver Dependencies

The modules rely on distinct database drivers that affect their installation requirements and connection methods. In src/patator/patator.py, the Pgsql_login class imports psycopg2 at lines 3019-3022, while MySQL_login imports MySQLdb._mysql from the mysqlclient library at lines 2830-2832.

• PostgreSQL: Requires the psycopg (psycopg2) library
• MySQL: Requires the mysqlclient library (specifically the _mysql module)

These dependencies determine the available connection parameters and error types each module can handle natively.

Connection Parameters and SSL Support

The connection calls in src/patator/patator.py reveal significant functional differences between the two modules. The PostgreSQL implementation at lines 3045-3047 uses:

psycopg2.connect(host=…, port=int(port), user=user, password=password, 
                 database=database, sslmode=ssl, connect_timeout=int(timeout))

In contrast, the MySQL connection at lines 2856-2857 uses:

_mysql.connect(host=host, port=int(port), user=user, password=password, 
               connect_timeout=int(timeout))

Key distinctions include:

• Database Selection: The PostgreSQL module accepts a database parameter (defaulting to "postgres" at lines 3035-3036) allowing you to test authentication against a specific database schema. The MySQL module performs authentication at the server level without specifying a target database.

• SSL/TLS Support: The PostgreSQL module exposes an ssl option that maps directly to psycopg2's sslmode parameter (lines 3042-3043), supporting values like require, disable, or verify-ca. The MySQL module does not expose SSL flags in its command-line interface, leaving SSL configuration to the underlying client library.

Authentication Response Handling

Success and failure responses differ between the modules, affecting how you interpret results. According to lines 3048-3049 in src/patator/patator.py, the PostgreSQL module returns a fixed tuple:

'0', 'OK'

Conversely, the MySQL module at lines 5858-5859 returns the server version string:

'0', fp.get_server_info()

Error handling also varies significantly. The PostgreSQL module catches psycopg2.OperationalError at lines 5050-5052 and returns a code '1' with the error message. The MySQL module catches _mysql.Error at lines 6060-6063 and returns the raw error tuple (e.args), which typically contains MySQL-specific error codes and messages.

Module Selection and Practical Applications

When to Use Pgsql_login for PostgreSQL Testing

Choose the PostgreSQL authentication module when you need to brute-force credentials against a PostgreSQL instance that:

• Requires SSL/TLS connections: Use the ssl option to specify connection modes like ssl=require or ssl=disable
• Targets specific databases: Specify the database parameter to test authentication against non-default schemas (e.g., database=production_db)
• Needs standardized success indicators: The fixed 'OK' response simplifies parsing results in automated scripts

The module is optimized for fast credential verification without executing queries, making it ideal for initial access testing.

When to Use MySQL_login for MySQL Testing

Select the MySQL module when attacking MySQL servers where you:

• Need server version fingerprinting: The successful response includes the MySQL server version string via get_server_info(), aiding in vulnerability assessment
• Plan follow-up queries: Pair this module with Patator's MySQL_query module to execute arbitrary SQL commands (e.g., SHOW DATABASES;) after discovering valid credentials
• Accept plaintext connections: When SSL is not required or is handled at the network layer

The MySQL module focuses on server-level authentication, making it suitable for testing when database-level access verification comes after initial login.

Command-Line Usage Examples

PostgreSQL brute-force with SSL and specific database targeting:

patator pgsql_login host=192.168.1.10 user=FILE0 password=FILE1 \
       0=usernames.txt 1=passwords.txt database=myapp ssl=require \
       -x ignore:fgrep='password authentication failed for user'

MySQL brute-force ignoring access denied messages:

patator mysql_login host=192.168.1.20 user=FILE0 password=FILE1 \
       0=usernames.txt 1=passwords.txt \
       -x ignore:fgrep='Access denied for user'

MySQL query execution after successful authentication:

patator mysql_query host=192.168.1.20 user=valid_user password=valid_pass \
       query='SHOW DATABASES;' -x ignore:code=0

Summary

• Driver Architecture: PostgreSQL uses psycopg2 while MySQL uses MySQLdb._mysql, affecting available connection options and error types
• SSL Capabilities: Only the PostgreSQL module (Pgsql_login) exposes explicit SSL mode configuration via the ssl parameter
• Database Targeting: PostgreSQL supports testing against specific databases via the database argument; MySQL authenticates at the server level only
• Response Parsing: PostgreSQL returns fixed 'OK' messages on success, while MySQL returns server version information
• Post-Authentication: MySQL offers a companion MySQL_query module for SQL execution, while PostgreSQL focuses solely on connection testing

Frequently Asked Questions

Does Patator support SSL encryption for MySQL authentication?

The MySQL_login module does not expose SSL configuration options in its command-line interface, unlike the PostgreSQL module which supports sslmode via the ssl parameter. For MySQL connections, SSL would need to be enforced at the client library configuration level or network layer, as the module implementation in src/patator/patator.py does not include SSL flags in the _mysql.connect() call.

Can I target a specific database schema using the MySQL authentication module?

No, the MySQL module performs authentication at the server level only and does not accept a database parameter. The PostgreSQL module specifically includes this capability through its database argument (defaulting to "postgres"), allowing you to test credentials against specific database schemas as implemented at lines 3035-3036 of src/patator/patator.py.

Why do the modules return different success responses?

The PostgreSQL module returns a fixed '0', 'OK' tuple upon successful connection, providing a consistent indicator across all PostgreSQL versions. In contrast, the MySQL module returns '0', fp.get_server_info() where get_server_info() contains the MySQL server version string, offering additional reconnaissance value during penetration testing.

How should I filter false positives when brute-forcing PostgreSQL credentials?

According to the usage hint at lines 3027-3028 in src/patator/patator.py, filter failed authentication attempts using -x ignore:fgrep='password authentication failed for user'. For MySQL, use -x ignore:fgrep='Access denied for user' based on the hint at lines 2838-2839, which aligns with MySQL's specific error message format returned in the _mysql.Error exception tuple.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}