Hack Like a Pro: Linux Basics for the Aspiring Hacker, Part 15 (Creating a Secure Tunnel to MySQL) « Null Byte :: WonderHowTo

Welcome back, my budding hackers!In my continuing effort tobuild your basic Linux skills for hacking, I want to show you how to build a secure "tunnel" to MySQL.Of course, the techniques I use here could be used for any application, but since MySQL is such a critical app on most Linux installations, and since un-encrypted sessions to your MySQL database server could easily be sniffed and confidential information exposed, we'll use our database server as our example in this tutorial.This is not to say that an encrypted tunnel is foolproof from being hacked. As with anything, it can be hacked, but it makes it many times more difficult. If we leave the data un-encrypted, any script kiddie with a sniffer can see and grab our traffic to our database.We'll be using SSH or Secure Shell to encrypt our traffic. Every Linux distribution has a SSH server and client built in, unlike Windows where you will need to download one of many SSH clients such asPuTTY. OurBackTrackhas BSD OpenSSH built-in, so don't need to download and install anything to build a secure connection between our client and server.Like so many other applications in Linux, SSH operates on a server/client architecture. To successfully connect, you must have both the server and the client running.Step 1: Open BackTrack & Start MySQLMySQL has the capability of using SSH, but you must configure and compile it to do so. Since the default configuration of MySQL, such as ours on BackTrack, does not have SSH built-in, we need to do a workaround using the SSH built into the operating system and then connecting to MySQL. This will create an encrypted "tunnel" to our database, so that hackers can't view our transmissions back and forth to the database.In our example here, we'll be connecting between two BackTrack installations. I have shown you how to start MySQL from the GUI in theprevious Linux basics guide, but in many distributions of Linux you won't have that luxury, so let's start MySQL from the command line.bt > mysql_safe startNow, let's make certain that it started by checking our processes and "grepping" for mysql.bt > ps aux | grep mysqlStep 2: Generate KeysIn order for SSH to create its encrypted tunnel, it must first generate a key pair, a private key and a public key. These two keys will be used to encrypt and then decrypt the traffic over the tunnel. We can do this by typing:bt >sshd-generateAs we can see, SSH has generated a key pair from which it will now be able to generate our secure tunnel. I have created a user named "nullbyte" on this server that we will use to connect to this machine.Step 3: Start SSHFrom theclientmachine, we can now connect to that SSH server by typing:ssh -L3316:127.0.0.1:3306 nullbyte@192.168.1.112Here's a breakdown of what's in the command above.sshis the client command-L3316listens on port 3316127.0.0.1is the location of the SSH client daemon on the client machine3306is the default port of MySQL that we want the tunnel to on the server machinenullbyteis a user on the operating system on the server192.168.1.112the IP address of the MySQL serverWhen we execute this command, we get a connection to the remote machine on nullbyte's account as shown below.What we have done here is to connect to the SSH client daemon on our client system that then connects via port 3331 to the SSH server that then connects to port 3306 to connect to MySQL.Step 4: Connect to MySQL SecurelyNow that we are securely connected to the server that contains the MySQL database, we can now login to the database over this tunnel. I have a MySQL user named "test4" (not the OS user—we connected via an OS user and we connect to MySQL via a MySQL user) on that database. Let's now login to that user's account.mysql -u test4 -pAs you can see above, we have successfully connected to MySQL over this tunnel! All of the traffic between us and the remote database server is encrypted.To make certain that we connected to the remote server and not our local database, I created a database on the remote server named "nullbyte".Let's issue the "show databases;" command from the MySQL prompt.As you can see, we have connected to the remote database server as it has the "nullbyte" database.I'm hoping that you are finding theseLinux fundamentals tutorialsuseful as they help to build your knowledge base that is useful for all of your hacking activities. For instance, in the near future, I'll show you how to hack this encrypted tunnel, so keep coming back, my tenderfoot hackers!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseDigital tunnelimage via ShutterstockRelatedHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 11 (Apache Web Servers)News:How to Study for the White Hat Hacker Associate Certification (CWA)How To:The Essential Skills to Becoming a Master HackerHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 10 (Manipulating Text)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 14 (MySQL)Hack Like a Pro:Snort IDS for the Aspiring Hacker, Part 3 (Sending Intrusion Alerts to MySQL)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 6 (Networking Basics)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 1 (Getting Started)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 25 (Inetd, the Super Daemon)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 2 (Creating Directories & Files)How to Hack Like a Pro:Getting Started with MetasploitHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 21 (GRUB Bootloader)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 13 (Mounting Drives & Devices)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 12 (Loadable Kernel Modules)Hack Like a Pro:How to Create a Nearly Undetectable Covert Channel with TunnelshellHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 9 (Managing Environmental Variables)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 22 (Samba)How to Hack Databases:Hacking MySQL Online Databases with SqlmapHack Like a Pro:Linux Basics for the Aspiring Hacker, Part 5 (Installing New Software)Goodnight Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Create an SSH Tunnel Server and Client in LinuxGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHack Logs and Linux Commands:What's Going On Here?Community Byte:HackThisSite Walkthrough, Part 6 - Legal Hacker TrainingHow To:Create a Free SSH Account on Shellmix to Use as a Webhost & MoreSecure Your Computer, Part 2:Password-Protect the GRUB Bootloader on Dual-Booted PCsGoodnight Byte:HackThisSite, Realistic 4 - Real Hacking SimulationsHow To:Mask Your IP Address and Remain Anonymous with OpenVPN for LinuxHow To:Remotely Control Computers Over VNC Securely with SSHCommunity Byte:HackThisSite Walkthrough, Part 1 - Legal Hacker TrainingHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterGoodnight Byte:HackThisSite Walkthrough, Part 8 - Legal Hacker TrainingCommunity Byte:HackThisSite Walkthrough, Part 2 - Legal Hacker TrainingHow To:Hack Wireless Router Passwords & Networks Using HydraNews:Anonymity, Darknets and Staying Out of Federal Custody, Part Four: The Invisible InternetHow To:Safely Log In to Your SSH Account Without a Password