Skip to content
HackIndex.io

MySQL Post-Exploitation Enumeration

3 min read Created Mar 26, 2026 Last updated Jul 14, 2026

After gaining authenticated access to MySQL, post-exploitation enumeration maps the full attack surface beyond the immediately visible databases and tables. Key areas to enumerate:

  • Stored procedures and functions that may contain hardcoded credentials or internal service addresses
  • Scheduled events that run on a timer and can be abused for persistence
  • Triggers on data changes worth checking for interception opportunities
  • Replication configuration revealing other database servers in the environment
  • Active connections exposing internal application servers and source IPs

MySQL Post-Exploitation Enumeration of Stored Procedures and Functions

Stored procedures frequently contain hardcoded credentials, internal service addresses, and sensitive business logic:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_TYPE FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_DEFINITION FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"

Read the full definition of any interesting procedure:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW CREATE PROCEDURE appdb.sync_users\G"

Enumerate Scheduled Events

MySQL events are SQL statements that execute on a schedule. They can be abused for persistence and may contain credentials or reveal automated maintenance operations:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT EVENT_SCHEMA, EVENT_NAME, STATUS, EVENT_DEFINITION, EXECUTE_AT, INTERVAL_VALUE, INTERVAL_FIELD FROM information_schema.EVENTS;"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW EVENTS\G"

Enumerate Triggers

Triggers fire automatically on INSERT, UPDATE, or DELETE operations. A trigger on a users table could be logging credential changes to a separate table:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT TRIGGER_SCHEMA, TRIGGER_NAME, EVENT_MANIPULATION, EVENT_OBJECT_TABLE, ACTION_STATEMENT FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"

Enumerate Replication Configuration

Replication configuration reveals other MySQL servers in the environment and the replication user credentials:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW REPLICA STATUS\G"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW MASTER STATUS\G"

The replica status output includes the source host, replication user, and port. This reveals additional database servers in the environment. The replication user account is a valid MySQL credential on the source server and worth testing against both MySQL and other services on the source host.

Enumerate Active Connections and Running Queries

The process list shows all currently connected clients, their source hosts, and what queries they are running:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW FULL PROCESSLIST;"

Application servers connecting to the database are visible in the process list with their source IP addresses. These are internal hosts in the environment worth enumerating for lateral movement.

Check General and Binary Logs

If query logging is enabled, the general log contains a record of every query executed including those with embedded credentials:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW VARIABLES LIKE 'general_log%'; SHOW VARIABLES LIKE 'log_bin%';"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT LOAD_FILE('/var/log/mysql/mysql.log');"

References