On this page 27 sections
  1. What MySQL is
  2. Default port
  3. Initial enumeration
  4. Useful Nmap scripts
  5. Connect with the MySQL client
  6. Basic database enumeration
  7. Select a database
  8. Enumerate tables
  9. Inspect table structure
  10. Query table data
  11. INFORMATION_SCHEMA
  12. Current privileges
  13. Enumerate MySQL users
  14. Users and allowed hosts
  15. secure_file_priv
  16. FILE privilege
  17. Read files with LOAD_FILE
  18. LOAD DATA INFILE
  19. MySQL authentication testing
  20. Metasploit MySQL version
  21. Metasploit MySQL login
  22. Metasploit MySQL enumeration
  23. Execute SQL with Metasploit
  24. Schema dump with Metasploit
  25. MySQL service vs SQL injection
  26. Enumeration workflow
  27. Quick reference
Lab use only. Apply these techniques only to systems you own or have explicit permission to test.
01

What MySQL is

MySQL is a relational database management system that uses SQL to store, retrieve and manage structured data. Applications commonly use MySQL to store users, configuration, application data and authentication information.

02

Default port

MySQL normally listens on TCP port 3306. A remotely reachable MySQL service should be enumerated independently from any web application using the database.

03

Initial enumeration

Start by identifying whether MySQL is reachable and determining the database server version.

MySQL version detection
nmap -sV -p 3306 <TARGET>
Default MySQL enumeration
nmap -sC -sV -p 3306 <TARGET>
04

Useful Nmap scripts

Nmap includes NSE scripts that can collect MySQL server information and capabilities.

MySQL information
nmap -p 3306 --script mysql-info <TARGET>
List MySQL scripts
ls /usr/share/nmap/scripts/mysql*
05

Connect with the MySQL client

The mysql command-line client can connect to remote MySQL servers when valid credentials and network access are available.

Remote connection
mysql -h <TARGET> -u <USERNAME> -p
Custom port
mysql -h <TARGET> -P <PORT> -u <USERNAME> -p
06

Basic database enumeration

Once authenticated, begin by identifying the current user, server version and available databases.

Current user
SELECT USER();
Server version
SELECT VERSION();
List databases
SHOW DATABASES;
07

Select a database

USE changes the active database for subsequent queries.

Select database
USE <DATABASE>;
08

Enumerate tables

Once a database is selected, SHOW TABLES lists the tables available to the current account.

List tables
SHOW TABLES;
09

Inspect table structure

DESCRIBE shows the fields and column types of a table and helps determine what information it stores.

Describe table
DESCRIBE <TABLE>;
10

Query table data

SELECT retrieves data from tables. During authorised enumeration, focus on information relevant to understanding application configuration and account structure.

Read table
SELECT * FROM <TABLE>;
Read selected columns
SELECT <COLUMN1>, <COLUMN2> FROM <TABLE>;
11

INFORMATION_SCHEMA

INFORMATION_SCHEMA is a system database containing metadata about databases, tables, columns and privileges. It is useful for structured enumeration when direct SHOW commands are insufficient.

List schemas
SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA;
List tables
SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES;
List columns
SELECT TABLE_SCHEMA, TABLE_NAME, COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS;
12

Current privileges

SHOW GRANTS displays the privileges assigned to the current authenticated account.

Current grants
SHOW GRANTS;
13

Enumerate MySQL users

Accounts with sufficient privileges may be able to inspect MySQL user information. Access to the mysql system database varies by version and account permissions.

Users and hosts
SELECT user, host FROM mysql.user;
14

Users and allowed hosts

A MySQL account consists of both a username and a host component. The same username may have different privileges depending on the source host from which it connects.

Inspect account mappings
SELECT user, host FROM mysql.user;
15

secure_file_priv

secure_file_priv controls where MySQL is allowed to read or write files using certain SQL file operations. Its value is important when evaluating database file-access capabilities.

Check secure_file_priv
SHOW VARIABLES LIKE 'secure_file_priv';
16

FILE privilege

The FILE privilege allows certain server-side file operations. It should be treated as a sensitive database privilege because file operations occur from the MySQL server context.

Inspect privileges
SHOW GRANTS;
17

Read files with LOAD_FILE

When permissions and MySQL configuration allow it, LOAD_FILE can read a file from the filesystem visible to the MySQL server process.

Read server-side file
SELECT LOAD_FILE('/path/to/file');
18

LOAD DATA INFILE

LOAD DATA INFILE imports file content into a table. Its availability depends on MySQL privileges, configuration and filesystem access.

Import file into table
LOAD DATA INFILE '/path/to/file' INTO TABLE <TABLE>;
19

MySQL authentication testing

When credential testing is authorised, discovered usernames and passwords can be validated against the MySQL service. Account lockout behaviour depends on the environment and surrounding controls.

Hydra MySQL testing
hydra -L <USERLIST> -P <PASSWORDLIST> mysql://<TARGET>
20

Metasploit MySQL version

Metasploit contains several auxiliary modules for MySQL enumeration and authentication testing.

Version scanner
use auxiliary/scanner/mysql/mysql_version
Set target
set RHOSTS <TARGET>
Run scanner
run
21

Metasploit MySQL login

mysql_login can validate username and password combinations against the database service.

Login scanner
use auxiliary/scanner/mysql/mysql_login
Show options
show options
22

Metasploit MySQL enumeration

Once valid credentials are available, Metasploit can perform additional MySQL enumeration.

MySQL enumeration
use auxiliary/admin/mysql/mysql_enum
23

Execute SQL with Metasploit

The mysql_sql module executes an SQL statement using supplied MySQL credentials.

SQL module
use auxiliary/admin/mysql/mysql_sql
Show options
show options
24

Schema dump with Metasploit

The schema-dump module can collect database schema information when the authenticated account has sufficient access.

Schema dump
use auxiliary/scanner/mysql/mysql_schemadump
25

MySQL service vs SQL injection

An exposed MySQL service and SQL injection are different attack surfaces. MySQL enumeration targets the database service directly, normally on port 3306. SQL injection is an application vulnerability where user-controlled input modifies a backend SQL query.

26

Enumeration workflow

Identify the MySQL service and version, obtain or validate credentials when authorised, enumerate databases and tables, inspect INFORMATION_SCHEMA, identify users and privileges, and then review sensitive capabilities such as FILE and secure_file_priv.

Initial scan
nmap -sC -sV -p 3306 <TARGET>
Connect
mysql -h <TARGET> -u <USERNAME> -p
List databases
SHOW DATABASES;
Privileges
SHOW GRANTS;
27

Quick reference

These are the MySQL enumeration commands worth remembering.

Nmap
nmap -sC -sV -p 3306 <TARGET>
Connect
mysql -h <TARGET> -u <USERNAME> -p
Databases
SHOW DATABASES;
Tables
SHOW TABLES;
Current user
SELECT USER();
Version
SELECT VERSION();
Grants
SHOW GRANTS;
secure_file_priv
SHOW VARIABLES LIKE 'secure_file_priv';
Metasploit version
use auxiliary/scanner/mysql/mysql_version
Metasploit login
use auxiliary/scanner/mysql/mysql_login