Identifying and enumerating exposed RDS instances using Nmap

Remember when we made our RDS instance publicly accessible? Well, it's time to identify such public RDS instances and exploit them.

In this scenario, we already know the hostname of our RDS instance, which makes it slightly easy for us. We'll start by running nmap scan on our instance to identify what ports are open:

1. SSH into your Kali machine, and issue the following command:

sudo nmap -sS -v -Pn <<RDS Instance>>

We can see that port 3306 is open, and is listening for any incoming connections:

2. Let's find out what service is running on port 3306:

sudo nmap -sS -A -vv -Pn -sV -p 3306 <<RDS Instance>>

3. So, it is a MySQL service. Let's find out more information about the MySQL service using Nmap Scripting Engine (NSE) scripts:

sudo nmap -sS -A -vv -Pn -sV -p 3306 --script...