MySQL Credential Harvesting from Application Configs
Mar 26, 2026
•
5 min read
MySQL:
Post-Exploitation
Enumerate MySQL internals, harvest creds from app configs
2 guides
•
Created Dec 28, 2025
•
Updated Mar 29, 2026
MySQL Post-Exploitation Enumeration
Covers MySQL enumeration techniques post-compromise, including user privilege extraction, database schema mapping, credential harvesting, and UDF-based privilege escalation paths.
Mar 26, 2026
•
3 min read
MySQL post-exploitation extracts credentials and sensitive data from a compromised instance. Password hashes in mysql.user are crackable offline, and application tables frequently store plaintext passwords, tokens, and API keys.
Review MySQL configuration files (my.cnf) for replication credentials and connection strings. Command history in .mysql_history and general query logs may contain passwords passed as query parameters or in plaintext connection attempts.