# MySQL

> MySQL attack coverage spanning version fingerprinting, user grants, default creds, FILE privilege abuse, UDF exploitation, hash cracking, config harvesting, and data exfiltration via dumps and file output

- **URL:** https://hackindex.io/services/mysql
- **Type:** Service
- **Default ports:** 3306
- **Tags:** mysql, database, sql, linux, relational-db
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

MySQL runs on **TCP port 3306** and is one of the most widely deployed relational databases. Nmap identifies it as `mysql`. MySQL and its fork MariaDB power a large share of web applications and are common targets in both external and internal assessments.

Remote root login without a password, weak credentials, and overly permissive user grants are frequent findings. MySQL's `LOAD_FILE()` and `INTO OUTFILE` functions can read and write files on the server when the database user has sufficient privileges. User-defined functions (UDFs) provide a path to OS command execution.

Connect with `mysql` client or test credentials with `hydra` and `crackmapexec`. After login, check the current user's privileges, enumerate databases, and look for sensitive data. Nmap's `mysql-info`, `mysql-enum`, and `mysql-empty-password` scripts cover initial enumeration.

## Phases

- [Enumeration](https://hackindex.io/services/mysql/enumeration.md): Covers MySQL version, auth, databases, users, grants, and data (1 guides)
- [Vulnerability Discovery](https://hackindex.io/services/mysql/vulnerability-discovery.md): Default creds, FILE privilege, remote access, and weak hash checks (4 guides)
- [Exploitation](https://hackindex.io/services/mysql/exploitation.md): Brute-force, file read/write, UDF abuse, and hash cracking guides (5 guides)
- [Post-Exploitation](https://hackindex.io/services/mysql/post-exploitation.md): Enumerate MySQL internals, harvest creds from app configs (2 guides)
- [Data Exfiltration](https://hackindex.io/services/mysql/data-exfiltration.md): Guides for extracting MySQL data via dumps, queries, and file output (1 guides)