It would be awesome if we could also have tests for the following points:

• Postgres version
  • Note CVE-2013-1899 Argument injection vulnerability in PostgreSQL before 9.2.4, 9.1.9, and 9.0.13)
• Portscanning (N/A)
• pg_shadow
• pg_extensions
• users with CREATEROLE
• Privesc
• Modify password
• Members of:
  • pg_execute_server_program (execute programs)
  • pg_read_server_files (read files)
  • pg_write_server_files (write files)
• Users with execute permissions on
  • pg_ls_dir
  • pg_read_file
  • pg_read_binary_file
  • pg_read_server_files (required for COPY)
  • pg_write_server_files (required for COPY)
  • pg_execute_server_program (required for COPY)
  • blink_connect_u (required for dblink without superuser privilleges)
• Ownership of objects (to be refined what is actually to be checked)
• pg_hba trust
• function with SECURITY DEFINER
• rce-with-postgresql-languages
• rce-with-postgresql-extensions
• postgresql-configuration-file-rce
• rce-with-ssl_passphrase_command
• rce-with-archive_command
• alter-table-privesc
• priv esc with local login
• pl-pgsql-password-bruteforce
• upload big binary files e.a. to abuse a modified version of udfhack, or bind a shell
  • Note that there is ACL permissions that would limit the vulnerability

It would be awesome, if a test fails we could also have the actual records printed out

We constantly write a cumbersome query which basically runs 2 queries returning integers, converts both to floats, divides them and returns the division.
As an example we query the number of users with an md5 password (dividend) and divide by total number of users (divisor).
Then we convert both into a float, divide the dividend by the divisor, and the result is returned as a float.
This is very cumbersome to write, and having defaults is difficult aswel.
Lets change this so that we have 2 queries:

• One for the dividend
• One for the divisor

Both could return an integer (we can easily convert the into float in go), and the division can be done in go aswel.
Interestingly, we could run with 'sane defaults', such that

• empty string for the dividend would become min
• empty string for the divisor would become 1
• divisor returning zero would not be a division by zero error, but rather max

We could have more info such as a url, or a message helping to resolve the issue.
But we should also have another log level, where

• debug is most verbose
• new level is info for every test
• info is only the end result

Also, 'reading from stdin' should be debug level msg