Skip to content
HackIndex logo

HackIndex

MySQL Remote Access Misconfiguration

3 min read Mar 29, 2026

MySQL is intended to be accessed from the application server on the same host or internal network. When it is bound to a public interface and user accounts allow connections from any host (%), the database is directly reachable from the internet or from any system on the network segment. Combined with weak or default credentials this is immediately exploitable. Even with strong credentials, network exposure of MySQL is a misconfiguration worth documenting — it reduces the attack surface from requiring application-layer compromise to requiring only credential access.

Confirm Network Exposure

Check whether port 3306 responds from outside the host:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p ${PORT:-3306} $TARGET_IP 
PORT     STATE SERVICE VERSION
3306/tcp open  mysql   MySQL 8.0.32 MySQL Community Server

A responding MySQL service on a public or DMZ IP address confirms the instance is network-exposed. Compare the target IP against the expected internal network range — a database responding on a public IP is a higher severity finding than one on an internal subnet.

Check the Bind Address

Once connected, confirm what interface MySQL is bound to:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SHOW VARIABLES LIKE 'bind_address';" 
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| bind_address  | *     |
+---------------+-------+

bind_address = * or 0.0.0.0 confirms MySQL is listening on all interfaces. bind_address = 127.0.0.1 or a specific internal IP means it is locally or network-restricted — you reached it through a tunnel or pivot rather than direct exposure.

Check User Account Host Restrictions

MySQL user accounts include a host field that restricts which source addresses can authenticate. Check whether accounts allow connections from any host:

┌──(kali㉿kali)-[~]
└─$ mysql -h $TARGET_IP -P ${PORT:-3306} -u $USER -p$PASSWORD -e "SELECT user, host, plugin FROM mysql.user ORDER BY host;" 
+------------------+------+-----------------------+
| user             | host | plugin                |
+------------------+------+-----------------------+
| root             | %    | caching_sha2_password |
| app_user         | %    | mysql_native_password |
| debian-sys-maint | localhost | caching_sha2_password |
+------------------+------+-----------------------+

Accounts with host = % accept connections from any IP address. A root account with host = % on a network-exposed instance means root-level database access is available from anywhere with the correct password. This is a critical finding regardless of password strength — the attack surface extends to the entire internet or network.

Verify on the Host if Shell Access is Available

If shell access is available on the database host, confirm the listening address from the OS side:

┌──(kali㉿kali)-[~]
└─$ ss -tlnp | grep 3306 
LISTEN  0  151  0.0.0.0:3306  0.0.0.0:*  users:(("mysqld",pid=1482,fd=24))
┌──(kali㉿kali)-[~]
└─$ grep -iE 'bind.address|skip.networking' /etc/mysql/mysql.conf.d/mysqld.cnf 2>/dev/null || grep -iE 'bind.address|skip.networking' /etc/my.cnf 2>/dev/null 
bind-address = 0.0.0.0

Document the Finding

Record the bind address, which user accounts allow remote connections, whether any of those accounts have weak or empty passwords, and whether the instance is internet-facing or internal. A publicly exposed MySQL instance with accounts allowing % host connections is directly accessible for credential-based attacks. Brute-force and default credential testing are covered in the exploitation phase.

References