
Nmap 6: Network Exploration and Security Auditing Cookbook

Web servers sometimes return database connection errors that reveal the MySQL username used by the web application. Penetration testers could use this information to perform brute force password auditing.
This recipe describes how to launch dictionary attacks against MySQL servers by using Nmap.
To perform brute force password auditing against MySQL servers by using Nmap, use the following command:
$ nmap -p3306 --script mysql-brute <target>
If valid credentials are found, they will be included in the mysql-brute
output section:
3306/tcp open mysql | mysql-brute: | root:<empty> => Valid credentials |_ test:test => Valid credentials
The script mysql-brute
was written by Patrik Karlsson and it is really helpful when auditing MySQL servers. It performs dictionary attacks to find valid credentials. The success rate will obviously depend on the dictionary files used when running the script.
The MySQL...
Change the font size
Change margin width
Change background colour