# Post-Exploitation

> Enumerate MySQL internals, harvest creds from app configs

- **URL:** https://hackindex.io/services/mysql/post-exploitation
- **Service:** [MySQL](https://hackindex.io/services/mysql.md)
- **Tags:** control, enumerate-internal
- **Published:** 2026-03-26
- **Updated:** 2026-03-29

MySQL post-exploitation extracts credentials and sensitive data from a compromised instance. Password hashes in mysql.user are crackable offline, and application tables frequently store plaintext passwords, tokens, and API keys.

Review MySQL configuration files (my.cnf) for replication credentials and connection strings. Command history in .mysql_history and general query logs may contain passwords passed as query parameters or in plaintext connection attempts.

## Guides

- [MySQL Credential Harvesting from Application Configs](https://hackindex.io/services/mysql/post-exploitation/mysql-credential-harvesting-from-application-configs.md)
- [MySQL Post-Exploitation Enumeration](https://hackindex.io/services/mysql/post-exploitation/mysql-post-exploitation-enumeration.md): Covers MySQL enumeration techniques post-compromise, including user privilege extraction, database schema mapping, credential harvesting, and UDF-based privilege escalation paths.