Ctrlk
📜 Medium🛒 My Shop👾 Github📩 Telegram 📺 YouTube✖ Twitter
For the complete documentation index, see llms.txt. This page is also available as Markdown.

HSQLDB - Port 9001

Basic info

What is HSQLDB?

HSQLDB (HyperSQL Database) is an open-source RDBMS written entirely in Java that offers:

  • Lightweight footprint - Small memory and disk requirements

  • Multiple modes - In-memory, file-based, or server-mode

  • JDBC compliance - Standard SQL database operations

  • Embedded capability - Can run within Java applications

  • SQL-92 compliance - Standard SQL syntax support

  • Java integration - Can call Java methods directly from SQL

Deployment Modes

1. In-Memory Mode:

2. File-Based Mode:

3. Server Mode (Network):

4. HTTP Mode:

Architecture

Common Use Cases

  • Embedded databases in Java applications

  • Testing environments for development

  • OpenOffice/LibreOffice Base backend

  • Apache OFBiz - Enterprise resource planning

  • Apache James - Mail server

  • Small to medium applications requiring lightweight DB

Default Port

Port 9001 - HSQLDB Network Server

Important Notes:

  • Often runs in memory-only mode (no network exposure)

  • Usually binds to localhost by default

  • If found externally, likely misconfigured

  • No authentication by default in older versions

Reconnaissance & Enumeration

Port Scanning

Basic Nmap Scan

Sample Output:

Service Fingerprinting

Banner Grabbing:

Version Detection:

Shodan Queries

Credential Discovery

Default Credentials

Common Default Credentials:

Authentication Testing:

Credential Hunting (Post-Exploitation)

Search for JDBC Connection Strings:

JDBC URL Examples:

Extract Database Name:

Connection & Enumeration

Connect Using GUI Client

Download and Run HSQLDB Manager:

Connect Using Command Line

Using HSQLDB CLI:

Using Java Code:

Database Enumeration

List Tables:

List Columns:

List Users:

List Privileges:

Database Version:

Extract Data:

Exploitation Techniques

Java Language Routines (JRTs)

Concept: HSQLDB can call static Java methods directly from SQL

Key Points:

  • Call any Java method in classpath

  • Access JDK classes (always available)

  • Read system properties

  • Read/write files

  • Execute commands (indirectly)

Method 1: Read Java System Properties

Create Function:

Execute Function:

Useful System Properties:

Method 2: Write Files to Disk

Create Procedure:

Write Webshell (JSP):

Write SSH Key:

Write Cron Job:

Important Notes:

  • Maximum size: 1024 bytes

  • Must hex-encode content

  • Need write permissions on target path

  • Path must be absolute

Method 3: Read Files (Indirect)

Using Java Reflection:

Alternative - Via System Properties:

Method 4: Command Execution (Advanced)

Using Runtime.exec() via Custom Procedure:

Note: Requires creating a custom Java class and adding to classpath

Step 1: Create Java Class

Step 2: Compile and Add to Classpath

Step 3: Create SQL Function

Limitation: This requires adding custom class to classpath, which usually means you already have significant access.

Method 5: Script Execution via File Write + Trigger

Concept: Write executable script, then trigger execution

Step 1: Write Script

Step 2: Make Executable (Challenge)

HSQLDB cannot directly change file permissions. Options:

  • Write to location with execute permissions

  • Write to web directory and execute via HTTP

  • Write cron job that executes script

  • Write to startup scripts

Method 6: JDBC URL Injection

If controlling JDBC URL:

Post-Exploitation

Data Exfiltration

Dump Entire Database:

Extract Sensitive Data:

Automated Dump Script:

Privilege Escalation

Check Current Privileges:

Create Admin User (If Admin):

Modify Existing User:

Persistence

Backdoor User:

Trigger-Based Backdoor:

Scheduled Task (If File Write Available):

Lateral Movement

Extract Connection Strings:

Credential Reuse:

Defense & Hardening

Secure Configuration

server.properties Configuration:

Set Strong Passwords:

Disable Dangerous Features:

Network Security

Firewall Rules:

Use SSH Tunnel:

Application Security

Use Connection Pooling:

Input Validation:

Least Privilege:

Monitoring & Detection

Enable Logging:

Monitor Logs:

Intrusion Detection:

Database Auditing:

Regular Security Practices

Tools & Scripts

Essential Tools

  1. HSQLDB Manager - GUI database client

  2. SqlTool - Command-line SQL client

  3. Java - Required for HSQLDB

  4. Custom Python scripts - Automation

Custom Enumeration Script

Exploitation Framework

Cheat Sheet

Quick Reference

Important Files

Useful System Properties

Conclusion

HSQLDB, while lightweight and convenient, introduces significant security risks through its Java integration capabilities and often weak default configurations. The ability to call arbitrary Java methods from SQL provides powerful exploitation opportunities for attackers.

Key Takeaways:

  1. Never expose HSQLDB externally - Bind to localhost only

  2. Set strong passwords - Change default SA blank password

  3. Restrict Java Language Routines - Limit JRT access if possible

  4. Monitor file write operations - Alert on suspicious writes

  5. Use minimal privileges - Grant only necessary permissions

  6. Regular security audits - Review users and functions

  7. Keep updated - Apply security patches

  8. Network segmentation - Firewall HSQLDB port

  9. Application security - Use prepared statements

  10. Defense in depth - Multiple security layers

Attack Vectors:

  • Default credentials (sa/blank)

  • Java Language Routines (arbitrary Java calls)

  • File write via JavaUtils

  • System property disclosure

  • SQL injection (application-level)

  • Privilege escalation

  • Data exfiltration

Remember to only perform these techniques during authorized security assessments. Unauthorized access is illegal and unethical.

Additional Resources

Learn & practice For the Bug Bounty

Support VeryLazyTech 🎉
PreviousFastCGI - Port 9000
NextCassandra - Port 9042, 9160

Last updated

Was this helpful?