All language subtitles for 2. MySQL Dictionary Attack

[ELECTRONIC NOISES]

Now that we've seen how a
SQL Server looks on Unix,

we can dig in and
see how, would you

get a password given
a certain username?

We'll check our IP address and
then run Nmap scan with that.

Subdomain, we see
it's running on 3306.

We'll run a service
scan on that port.

And it confirms.

It's MySQL 5.5.62.

We're going to
utilize msfconsole

and an auxiliary scanner
to brute force the login.

And we'll set our
rhosts to our IP.

And we're going to
utilize a password file.

Using tab completion here
makes things go a lot quicker.

We'll verbose to false.

That way, we don't get
too much stuff on screen.

And we'll set
stop_on_success to true

since we only have one
password for the username.

And then we'll set
username to root.

We'll run that scan.

It brute forces fairly quickly,
and we get root and catalina.

Another way you could go
about this is utilize hydra.

Hydra is great-- lowercase l
for our username, uppercase P

for password file.

We use that same word list.

It's a good word list.

There are many word lists out
there that you could find.

You put the IP address and
then the protocol MySQL.

And hydra will take
care of the rest.

It knows what port to look for.

It knows it's 3306.

If you had a non-standard port,
you would pass that in as well.

And our scan completed.

We see that with root.

It worked with catalina.

And that's how you can brute
force your log in for MySQL,

two different ways.

There are many others.

You could script it out with
C++ or Python or bash scripting.

But these tools are already
there, ready and waiting.