Skip to content
HackIndex logo

HackIndex

MySQL Post-Exploitation Enumeration

3 min read Jul 14, 2026

After gaining authenticated access to MySQL, post-exploitation enumeration maps the full attack surface beyond the immediately visible databases and tables. Stored procedures and functions may contain credentials or business logic worth reviewing. Scheduled events run commands on a timer and can be abused for persistence. Triggers fire on data changes and are worth checking for data interception opportunities. Replication configuration reveals other database servers in the environment. Each of these surfaces provides either additional credential material or lateral movement paths.

Enumerate Stored Procedures and Functions

Stored procedures frequently contain hardcoded credentials, internal service addresses, and sensitive business logic:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_TYPE FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_DEFINITION FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"

Read the full definition of any interesting procedure:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW CREATE PROCEDURE appdb.sync_users\G"

Enumerate Scheduled Events

MySQL events are SQL statements that execute on a schedule. They can be abused for persistence and may contain credentials or reveal automated maintenance operations:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT EVENT_SCHEMA, EVENT_NAME, STATUS, EVENT_DEFINITION, EXECUTE_AT, INTERVAL_VALUE, INTERVAL_FIELD FROM information_schema.EVENTS;"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW EVENTS\G"

Enumerate Triggers

Triggers fire automatically on INSERT, UPDATE, or DELETE operations. A trigger on a users table could be logging credential changes to a separate table:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT TRIGGER_SCHEMA, TRIGGER_NAME, EVENT_MANIPULATION, EVENT_OBJECT_TABLE, ACTION_STATEMENT FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"

Enumerate Replication Configuration

Replication configuration reveals other MySQL servers in the environment and the replication user credentials:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW REPLICA STATUS\G"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW MASTER STATUS\G"

The replica status output includes the source host, replication user, and port. This reveals additional database servers in the environment. The replication user account is a valid MySQL credential on the source server and worth testing against both MySQL and other services on the source host.

Enumerate Active Connections and Running Queries

The process list shows all currently connected clients, their source hosts, and what queries they are running:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW FULL PROCESSLIST;"

Application servers connecting to the database are visible in the process list with their source IP addresses. These are internal hosts in the environment worth enumerating for lateral movement.

Check General and Binary Logs

If query logging is enabled, the general log contains a record of every query executed including those with embedded credentials:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW VARIABLES LIKE 'general_log%'; SHOW VARIABLES LIKE 'log_bin%';"
┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT LOAD_FILE('/var/log/mysql/mysql.log');"

References