Original subtitles

[ELECTRONIC NOISES]

Now that we've seen how a SQL Server looks on Unix,

we can dig in and see how, would you

get a password given a certain username?

We'll check our IP address and then run Nmap scan with that.

Subdomain, we see it's running on 3306.

We'll run a service scan on that port.

And it confirms.

It's MySQL 5.5.62.

We're going to utilize msfconsole

and an auxiliary scanner to brute force the login.

And we'll set our rhosts to our IP.

And we're going to utilize a password file.

Using tab completion here makes things go a lot quicker.

We'll verbose to false.

That way, we don't get too much stuff on screen.

And we'll set stop_on_success to true

since we only have one password for the username.

And then we'll set username to root.

We'll run that scan.

It brute forces fairly quickly, and we get root and catalina.

Another way you could go about this is utilize hydra.

Hydra is great-- lowercase l for our username, uppercase P

for password file.

We use that same word list.

It's a good word list.

There are many word lists out there that you could find.

You put the IP address and then the protocol MySQL.

And hydra will take care of the rest.

It knows what port to look for.

It knows it's 3306.

If you had a non-standard port, you would pass that in as well.

And our scan completed.

We see that with root.

It worked with catalina.

And that's how you can brute force your log in for MySQL,

two different ways.

There are many others.

You could script it out with C++ or Python or bash scripting.

But these tools are already there, ready and waiting.