The HackTricks MySQL Pentesting Guide provides a comprehensive methodology for identifying, enumerating, and exploiting MySQL services. The following sections detail the core techniques for interacting with MySQL as part of a security assessment. 1. External Enumeration & Connection
Note: This is noisy and often flagged by AV, but remains a classic verified hack.
2.4 Abusing MySQL Logs to Write Shells (No secure_file_priv needed)
If secure_file_priv is NULL, you cannot use INTO OUTFILE. However, you can tamper with logs.
Industry Recognition: HackTricks is often cited in academic research and professional certifications as a reliable educational reference for offensive security. Pros and Cons HackTricks Training | Cloud Hacking Certifications
Cracking: Use hashcat -m 300 for mysql_native_password (4 bytes salt + 20 bytes SHA1) or -m 7400 for caching_sha2_password.
- Dump Database:
mysqldump -u username -p password database > database.sql - Search for Sensitive Data:
SELECT \* FROM table_name WHERE column_name LIKE '%sensitive_data%'; - Create a Backdoor:
GRANT ALL PRIVILEGES ON \*.\* TO 'backdoor\_user'@'%' IDENTIFIED BY 'backdoor\_password';
Check for the plugin directory: show variables like 'plugin_dir'; Transfer the UDF library to that folder.
Credential Extraction: Verified methods for pulling password hashes from the mysql.user table or finding cleartext credentials in configuration files like my.cnf.