audit-labs/audit-tools
A collection of scripts, queries, and other goodies you can use in an audit.
clone: git clone https://gitbay.org/audit-labs/audit-tools.git
95bf612c338dec8235e89ca6a1d9e5e8cad3f997
signed_unknown_key
author: Christian Cleberg <hello@cleberg.net> · 2025-05-07T02:31:46Z
committer: <noreply@github.com>
README.md | 27 +++-- databases/administrators/mysql/README.org | 108 -------------------- databases/{administrators => }/mongo/README.org | 0 databases/{administrators => }/mongo/admins.py | 0 databases/{passwords => }/mysql/README.org | 109 ++++++++++++++++++++- .../{administrators => }/mysql/mysql_admins.sql | 0 .../mysql/mysql_admins_alt.sql | 0 databases/{passwords => }/mysql/passwords.sql | 0 .../{administrators => }/oracle/oracle_admins.sql | 0 .../oracle/oracle_admins_alt.sql | 0 databases/passwords/postgres/README.org | 31 ------ databases/{administrators => }/postgres/README.org | 32 +++++- databases/{administrators => }/postgres/admins.sql | 0 databases/{passwords => }/postgres/passwords.sql | 0 .../mssql_admins.sql => sql/admins.sql} | 0 .../{passwords/sql => sql/passwords}/data.csv | 0 .../{passwords/sql => sql/passwords}/get_data.sql | 0 databases/{passwords/sql => sql/passwords}/test.py | 0 18 files changed, 158 insertions(+), 149 deletions(-) @@ -36,25 +36,36 @@ tree -I ".git*|venv" │ ├── approvals.py │ ├── branch_protections.py │ ├── passwords.py +│ ├── pipelines.py │ ├── provisioning.py │ ├── README.org +│ ├── repositories.py │ └── users.py ├── CODEOWNERS ├── databases -│ ├── administrators -│ │ ├── mssql_admins.sql +│ ├── mongo +│ │ ├── admins.py +│ │ └── README.org +│ ├── mysql │ │ ├── mysql_admins_alt.sql -│ │ ├── mysql_admins.sh │ │ ├── mysql_admins.sql +│ │ ├── passwords.sql +│ │ └── README.org +│ ├── oracle │ │ ├── oracle_admins_alt.sql │ │ └── oracle_admins.sql -│ └── passwords -│ └── sql +│ ├── postgres +│ │ ├── admins.sql +│ │ ├── passwords.sql +│ │ └── README.org +│ └── sql +│ ├── admins.sql +│ └── passwords │ ├── data.csv │ ├── get_data.sql │ └── test.py ├── LICENSE -├── operating-systems +├── os │ └── linux │ ├── passwords.sh │ ├── README.org @@ -68,12 +79,12 @@ tree -I ".git*|venv" │ └── project_dashboard │ ├── project_dashboard.pbix │ └── project_data.xlsx -├── README.org +├── README.md ├── requirements.txt └── sampling ├── README.org - ├── sample-html.png ├── sample.html + ├── sample-html.png └── sample.py ``` deleted file mode 100644 @@ -1,108 +0,0 @@ -#+title: MySQL Admins - -* =mysql_admins.sql= - -#+begin_src sql -SELECT * FROM information_schema.user_privileges; -#+end_src - -#+begin_src -MySQL [(none)]> SELECT * FROM information_schema.user_privileges; -+--------------------------------+---------------+---------------------------------+--------------+ -| GRANTEE | TABLE_CATALOG | PRIVILEGE_TYPE | IS_GRANTABLE | -+--------------------------------+---------------+---------------------------------+--------------+ -| 'mysql.infoschema'@'localhost' | def | SELECT | NO | -| 'mysql.infoschema'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO | -| 'mysql.infoschema'@'localhost' | def | FIREWALL_EXEMPT | NO | -| 'mysql.infoschema'@'localhost' | def | SYSTEM_USER | NO | -| 'mysql.session'@'localhost' | def | SHUTDOWN | NO | -| 'mysql.session'@'localhost' | def | SUPER | NO | -| 'mysql.session'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO | -| 'mysql.session'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | NO | -| 'mysql.session'@'localhost' | def | BACKUP_ADMIN | NO | -| 'mysql.session'@'localhost' | def | CLONE_ADMIN | NO | -| 'mysql.session'@'localhost' | def | CONNECTION_ADMIN | NO | -| 'mysql.session'@'localhost' | def | FIREWALL_EXEMPT | NO | -| 'mysql.session'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | NO | -| 'mysql.session'@'localhost' | def | SESSION_VARIABLES_ADMIN | NO | -| 'mysql.session'@'localhost' | def | SYSTEM_USER | NO | -| 'mysql.session'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | NO | -| 'mysql.sys'@'localhost' | def | USAGE | NO | -| 'mysql.sys'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO | -| 'mysql.sys'@'localhost' | def | FIREWALL_EXEMPT | NO | -| 'mysql.sys'@'localhost' | def | SYSTEM_USER | NO | -| 'root'@'localhost' | def | SELECT | YES | -| 'root'@'localhost' | def | INSERT | YES | -| 'root'@'localhost' | def | UPDATE | YES | -| 'root'@'localhost' | def | DELETE | YES | -| 'root'@'localhost' | def | CREATE | YES | -| 'root'@'localhost' | def | DROP | YES | -| 'root'@'localhost' | def | RELOAD | YES | -| 'root'@'localhost' | def | SHUTDOWN | YES | -| 'root'@'localhost' | def | PROCESS | YES | -| 'root'@'localhost' | def | FILE | YES | -| 'root'@'localhost' | def | REFERENCES | YES | -| 'root'@'localhost' | def | INDEX | YES | -| 'root'@'localhost' | def | ALTER | YES | -| 'root'@'localhost' | def | SHOW DATABASES | YES | -| 'root'@'localhost' | def | SUPER | YES | -| 'root'@'localhost' | def | CREATE TEMPORARY TABLES | YES | -| 'root'@'localhost' | def | LOCK TABLES | YES | -| 'root'@'localhost' | def | EXECUTE | YES | -| 'root'@'localhost' | def | REPLICATION SLAVE | YES | -| 'root'@'localhost' | def | REPLICATION CLIENT | YES | -| 'root'@'localhost' | def | CREATE VIEW | YES | -| 'root'@'localhost' | def | SHOW VIEW | YES | -| 'root'@'localhost' | def | CREATE ROUTINE | YES | -| 'root'@'localhost' | def | ALTER ROUTINE | YES | -| 'root'@'localhost' | def | CREATE USER | YES | -| 'root'@'localhost' | def | EVENT | YES | -| 'root'@'localhost' | def | TRIGGER | YES | -| 'root'@'localhost' | def | CREATE TABLESPACE | YES | -| 'root'@'localhost' | def | CREATE ROLE | YES | -| 'root'@'localhost' | def | DROP ROLE | YES | -| 'root'@'localhost' | def | ALLOW_NONEXISTENT_DEFINER | YES | -| 'root'@'localhost' | def | APPLICATION_PASSWORD_ADMIN | YES | -| 'root'@'localhost' | def | AUDIT_ABORT_EXEMPT | YES | -| 'root'@'localhost' | def | AUDIT_ADMIN | YES | -| 'root'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | YES | -| 'root'@'localhost' | def | BACKUP_ADMIN | YES | -| 'root'@'localhost' | def | BINLOG_ADMIN | YES | -| 'root'@'localhost' | def | BINLOG_ENCRYPTION_ADMIN | YES | -| 'root'@'localhost' | def | CLONE_ADMIN | YES | -| 'root'@'localhost' | def | CONNECTION_ADMIN | YES | -| 'root'@'localhost' | def | CREATE_SPATIAL_REFERENCE_SYSTEM | YES | -| 'root'@'localhost' | def | ENCRYPTION_KEY_ADMIN | YES | -| 'root'@'localhost' | def | FIREWALL_EXEMPT | YES | -| 'root'@'localhost' | def | FLUSH_OPTIMIZER_COSTS | YES | -| 'root'@'localhost' | def | FLUSH_PRIVILEGES | YES | -| 'root'@'localhost' | def | FLUSH_STATUS | YES | -| 'root'@'localhost' | def | FLUSH_TABLES | YES | -| 'root'@'localhost' | def | FLUSH_USER_RESOURCES | YES | -| 'root'@'localhost' | def | GROUP_REPLICATION_ADMIN | YES | -| 'root'@'localhost' | def | GROUP_REPLICATION_STREAM | YES | -| 'root'@'localhost' | def | INNODB_REDO_LOG_ARCHIVE | YES | -| 'root'@'localhost' | def | INNODB_REDO_LOG_ENABLE | YES | -| 'root'@'localhost' | def | OPTIMIZE_LOCAL_TABLE | YES | -| 'root'@'localhost' | def | PASSWORDLESS_USER_ADMIN | YES | -| 'root'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | YES | -| 'root'@'localhost' | def | REPLICATION_APPLIER | YES | -| 'root'@'localhost' | def | REPLICATION_SLAVE_ADMIN | YES | -| 'root'@'localhost' | def | RESOURCE_GROUP_ADMIN | YES | -| 'root'@'localhost' | def | RESOURCE_GROUP_USER | YES | -| 'root'@'localhost' | def | ROLE_ADMIN | YES | -| 'root'@'localhost' | def | SENSITIVE_VARIABLES_OBSERVER | YES | -| 'root'@'localhost' | def | SERVICE_CONNECTION_ADMIN | YES | -| 'root'@'localhost' | def | SESSION_VARIABLES_ADMIN | YES | -| 'root'@'localhost' | def | SET_ANY_DEFINER | YES | -| 'root'@'localhost' | def | SHOW_ROUTINE | YES | -| 'root'@'localhost' | def | SYSTEM_USER | YES | -| 'root'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | YES | -| 'root'@'localhost' | def | TABLE_ENCRYPTION_ADMIN | YES | -| 'root'@'localhost' | def | TELEMETRY_LOG_ADMIN | YES | -| 'root'@'localhost' | def | TRANSACTION_GTID_TAG | YES | -| 'root'@'localhost' | def | XA_RECOVER_ADMIN | YES | -| 'cmc'@'%' | def | USAGE | NO | -+--------------------------------+---------------+---------------------------------+--------------+ -92 rows in set (0.001 sec) -#+end_src similarity index 100% rename from databases/administrators/mongo/README.org rename to databases/mongo/README.org similarity index 100% rename from databases/administrators/mongo/admins.py rename to databases/mongo/admins.py similarity index 52% rename from databases/passwords/mysql/README.org rename to databases/mysql/README.org @@ -1,7 +1,114 @@ -#+title: MySQL Passwords +#+title: MySQL * =mysql_admins.sql= +#+begin_src sql +SELECT * FROM information_schema.user_privileges; +#+end_src + +#+begin_src +MySQL [(none)]> SELECT * FROM information_schema.user_privileges; ++--------------------------------+---------------+---------------------------------+--------------+ +| GRANTEE | TABLE_CATALOG | PRIVILEGE_TYPE | IS_GRANTABLE | ++--------------------------------+---------------+---------------------------------+--------------+ +| 'mysql.infoschema'@'localhost' | def | SELECT | NO | +| 'mysql.infoschema'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO | +| 'mysql.infoschema'@'localhost' | def | FIREWALL_EXEMPT | NO | +| 'mysql.infoschema'@'localhost' | def | SYSTEM_USER | NO | +| 'mysql.session'@'localhost' | def | SHUTDOWN | NO | +| 'mysql.session'@'localhost' | def | SUPER | NO | +| 'mysql.session'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO | +| 'mysql.session'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | NO | +| 'mysql.session'@'localhost' | def | BACKUP_ADMIN | NO | +| 'mysql.session'@'localhost' | def | CLONE_ADMIN | NO | +| 'mysql.session'@'localhost' | def | CONNECTION_ADMIN | NO | +| 'mysql.session'@'localhost' | def | FIREWALL_EXEMPT | NO | +| 'mysql.session'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | NO | +| 'mysql.session'@'localhost' | def | SESSION_VARIABLES_ADMIN | NO | +| 'mysql.session'@'localhost' | def | SYSTEM_USER | NO | +| 'mysql.session'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | NO | +| 'mysql.sys'@'localhost' | def | USAGE | NO | +| 'mysql.sys'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO | +| 'mysql.sys'@'localhost' | def | FIREWALL_EXEMPT | NO | +| 'mysql.sys'@'localhost' | def | SYSTEM_USER | NO | +| 'root'@'localhost' | def | SELECT | YES | +| 'root'@'localhost' | def | INSERT | YES | +| 'root'@'localhost' | def | UPDATE | YES | +| 'root'@'localhost' | def | DELETE | YES | +| 'root'@'localhost' | def | CREATE | YES | +| 'root'@'localhost' | def | DROP | YES | +| 'root'@'localhost' | def | RELOAD | YES | +| 'root'@'localhost' | def | SHUTDOWN | YES | +| 'root'@'localhost' | def | PROCESS | YES | +| 'root'@'localhost' | def | FILE | YES | +| 'root'@'localhost' | def | REFERENCES | YES | +| 'root'@'localhost' | def | INDEX | YES | +| 'root'@'localhost' | def | ALTER | YES | +| 'root'@'localhost' | def | SHOW DATABASES | YES | +| 'root'@'localhost' | def | SUPER | YES | +| 'root'@'localhost' | def | CREATE TEMPORARY TABLES | YES | +| 'root'@'localhost' | def | LOCK TABLES | YES | +| 'root'@'localhost' | def | EXECUTE | YES | +| 'root'@'localhost' | def | REPLICATION SLAVE | YES | +| 'root'@'localhost' | def | REPLICATION CLIENT | YES | +| 'root'@'localhost' | def | CREATE VIEW | YES | +| 'root'@'localhost' | def | SHOW VIEW | YES | +| 'root'@'localhost' | def | CREATE ROUTINE | YES | +| 'root'@'localhost' | def | ALTER ROUTINE | YES | +| 'root'@'localhost' | def | CREATE USER | YES | +| 'root'@'localhost' | def | EVENT | YES | +| 'root'@'localhost' | def | TRIGGER | YES | +| 'root'@'localhost' | def | CREATE TABLESPACE | YES | +| 'root'@'localhost' | def | CREATE ROLE | YES | +| 'root'@'localhost' | def | DROP ROLE | YES | +| 'root'@'localhost' | def | ALLOW_NONEXISTENT_DEFINER | YES | +| 'root'@'localhost' | def | APPLICATION_PASSWORD_ADMIN | YES | +| 'root'@'localhost' | def | AUDIT_ABORT_EXEMPT | YES | +| 'root'@'localhost' | def | AUDIT_ADMIN | YES | +| 'root'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | YES | +| 'root'@'localhost' | def | BACKUP_ADMIN | YES | +| 'root'@'localhost' | def | BINLOG_ADMIN | YES | +| 'root'@'localhost' | def | BINLOG_ENCRYPTION_ADMIN | YES | +| 'root'@'localhost' | def | CLONE_ADMIN | YES | +| 'root'@'localhost' | def | CONNECTION_ADMIN | YES | +| 'root'@'localhost' | def | CREATE_SPATIAL_REFERENCE_SYSTEM | YES | +| 'root'@'localhost' | def | ENCRYPTION_KEY_ADMIN | YES | +| 'root'@'localhost' | def | FIREWALL_EXEMPT | YES | +| 'root'@'localhost' | def | FLUSH_OPTIMIZER_COSTS | YES | +| 'root'@'localhost' | def | FLUSH_PRIVILEGES | YES | +| 'root'@'localhost' | def | FLUSH_STATUS | YES | +| 'root'@'localhost' | def | FLUSH_TABLES | YES | +| 'root'@'localhost' | def | FLUSH_USER_RESOURCES | YES | +| 'root'@'localhost' | def | GROUP_REPLICATION_ADMIN | YES | +| 'root'@'localhost' | def | GROUP_REPLICATION_STREAM | YES | +| 'root'@'localhost' | def | INNODB_REDO_LOG_ARCHIVE | YES | +| 'root'@'localhost' | def | INNODB_REDO_LOG_ENABLE | YES | +| 'root'@'localhost' | def | OPTIMIZE_LOCAL_TABLE | YES | +| 'root'@'localhost' | def | PASSWORDLESS_USER_ADMIN | YES | +| 'root'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | YES | +| 'root'@'localhost' | def | REPLICATION_APPLIER | YES | +| 'root'@'localhost' | def | REPLICATION_SLAVE_ADMIN | YES | +| 'root'@'localhost' | def | RESOURCE_GROUP_ADMIN | YES | +| 'root'@'localhost' | def | RESOURCE_GROUP_USER | YES | +| 'root'@'localhost' | def | ROLE_ADMIN | YES | +| 'root'@'localhost' | def | SENSITIVE_VARIABLES_OBSERVER | YES | +| 'root'@'localhost' | def | SERVICE_CONNECTION_ADMIN | YES | +| 'root'@'localhost' | def | SESSION_VARIABLES_ADMIN | YES | +| 'root'@'localhost' | def | SET_ANY_DEFINER | YES | +| 'root'@'localhost' | def | SHOW_ROUTINE | YES | +| 'root'@'localhost' | def | SYSTEM_USER | YES | +| 'root'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | YES | +| 'root'@'localhost' | def | TABLE_ENCRYPTION_ADMIN | YES | +| 'root'@'localhost' | def | TELEMETRY_LOG_ADMIN | YES | +| 'root'@'localhost' | def | TRANSACTION_GTID_TAG | YES | +| 'root'@'localhost' | def | XA_RECOVER_ADMIN | YES | +| 'cmc'@'%' | def | USAGE | NO | ++--------------------------------+---------------+---------------------------------+--------------+ +92 rows in set (0.001 sec) +#+end_src + +* =passwords.sql= + #+begin_src sql SELECT user, host, plugin FROM mysql.user; #+end_src similarity index 100% rename from databases/administrators/mysql/mysql_admins.sql rename to databases/mysql/mysql_admins.sql similarity index 100% rename from databases/administrators/mysql/mysql_admins_alt.sql rename to databases/mysql/mysql_admins_alt.sql similarity index 100% rename from databases/passwords/mysql/passwords.sql rename to databases/mysql/passwords.sql similarity index 100% rename from databases/administrators/oracle/oracle_admins.sql rename to databases/oracle/oracle_admins.sql similarity index 100% rename from databases/administrators/oracle/oracle_admins_alt.sql rename to databases/oracle/oracle_admins_alt.sql deleted file mode 100644 @@ -1,31 +0,0 @@ -#+title: Postgres Passwords - -* =passwords.sql= - -#+begin_src sql -SELECT * -FROM pg_settings -WHERE name LIKE 'password_%'; -#+end_src - -#+begin_src -| name | setting | unit | category | short_desc | extra_desc | context | vartype | source | min_val | max_val | enumvals | boot_val | reset_val | sourcefile | sourceline | pending_restart | -|---------------------+---------------+------+-------------------------------------------------+-------------------------------------------------+------------+---------+---------+---------+---------+---------+---------------------+---------------+---------------+------------+------------+-----------------| -| password_encryption | scram-sha-256 | | Connections and Authentication / Authentication | Chooses the algorithm for encrypting passwords. | | user | enum | default | | | {md5,scram-sha-256} | scram-sha-256 | scram-sha-256 | | | false | -#+end_src - -#+begin_src sql -SELECT - usename AS user_name, - passwd AS password, - valuntil AS valid_until, - useconfig AS user_config -FROM pg_shadow; -#+end_src - -#+begin_src -| user_name | password | valid_until | user_config | -|-----------+---------------------------------------------------------------------------------------------------------------------------------------+------------------------+-------------| -| cmc | | | | -| testuser | SCRAM-SHA-256$4096:+NSpEU+8afhJ4BUTkzdKeg==$FGIRcTWr89b42qkLUl4Ntfp4RUpoc3GIpLHqJl/fWZE=:o1UM8YiEj5SLV5l/geMuqXMRi6onWazryn/l+LXYMxU= | 2025-12-31 00:00:00-06 | | -#+end_src similarity index 72% rename from databases/administrators/postgres/README.org rename to databases/postgres/README.org @@ -1,4 +1,34 @@ -#+title: Postgres Admins +#+title: Postgres + +* =passwords.sql= + +#+begin_src sql +SELECT * +FROM pg_settings +WHERE name LIKE 'password_%'; +#+end_src + +#+begin_src +| name | setting | unit | category | short_desc | extra_desc | context | vartype | source | min_val | max_val | enumvals | boot_val | reset_val | sourcefile | sourceline | pending_restart | +|---------------------+---------------+------+-------------------------------------------------+-------------------------------------------------+------------+---------+---------+---------+---------+---------+---------------------+---------------+---------------+------------+------------+-----------------| +| password_encryption | scram-sha-256 | | Connections and Authentication / Authentication | Chooses the algorithm for encrypting passwords. | | user | enum | default | | | {md5,scram-sha-256} | scram-sha-256 | scram-sha-256 | | | false | +#+end_src + +#+begin_src sql +SELECT + usename AS user_name, + passwd AS password, + valuntil AS valid_until, + useconfig AS user_config +FROM pg_shadow; +#+end_src + +#+begin_src +| user_name | password | valid_until | user_config | +|-----------+---------------------------------------------------------------------------------------------------------------------------------------+------------------------+-------------| +| cmc | | | | +| testuser | SCRAM-SHA-256$4096:+NSpEU+8afhJ4BUTkzdKeg==$FGIRcTWr89b42qkLUl4Ntfp4RUpoc3GIpLHqJl/fWZE=:o1UM8YiEj5SLV5l/geMuqXMRi6onWazryn/l+LXYMxU= | 2025-12-31 00:00:00-06 | | +#+end_src * =admins.sql= similarity index 100% rename from databases/administrators/postgres/admins.sql rename to databases/postgres/admins.sql similarity index 100% rename from databases/passwords/postgres/passwords.sql rename to databases/postgres/passwords.sql similarity index 100% rename from databases/administrators/microsoft-sql/mssql_admins.sql rename to databases/sql/admins.sql similarity index 100% rename from databases/passwords/sql/data.csv rename to databases/sql/passwords/data.csv similarity index 100% rename from databases/passwords/sql/get_data.sql rename to databases/sql/passwords/get_data.sql similarity index 100% rename from databases/passwords/sql/test.py rename to databases/sql/passwords/test.py