Brute force a MySQL user using a wordlist file.
MySQL Brute was created for MySQL localhost account recovery
e.g.
- root account inaccessible
- mysqld not able to be restarted in safe mode for root reset
- user password is lost.
PLESK-managed MySQL admin user is a candidate.
- Linux
./mysqlbrute --help
./mysqlbrute -h <host> -u <username> -f <wordlist_file>
./mysqlbrute -h localhost -u wordpress -f top_100000.txtDownload a password-only wordlist e.g. Daniel Miessler's (others can be username:password combinations).
Alternatively a simple wordlist for testing can be the Linux dictionary (Debian path):
./mysqlbrute -h localhost -u <username> -f /usr/share/dict/wordsMAX_WORD_LEN of 50 in mysqlbrute.c is okay for most wordlists. However, some wordlists have borked entries (e.g. long email addresses included). For such wordlists, increase MAX_WORD_LEN to 140 (or more precisely, the output of wc -L <wordlist_file> + 1), and re-compile the source to avoid the resultant buffer overrun / segfault.
Other options:
-p <port_number>- x86 64-bit
- ARM 32-bit
Download the executables from Releases.
MySQL Brute churns through approximately 20,000 passwords per second (vanilla Core i3 desktop CPU) on a Unix localhost socket connection – considerably faster than the Bash and Python scripts I tried before creating MySQL Brute (and curiously, faster than the vaunted multi-threaded Hydra). However, when using a network connection, MySQL Brute is much slower – around 1,000 per second on a local network.
MySQL Brute's speed bottlenecks are:
- MySQL connect (
mysql_real_connect()), - MySQL spawning only a limited number of threads for connections,
- if not a localhost connection, the network connection (MySQL localhost connection uses a socket instead of TCP/IP).
If more speed is needed, there is 0x0mar's multi-threaded Mysql-bruteforce or my fork of this.
hydra -l wordpress -P top_100000.txt -t 4 -F localhost mysql(As per the example in Usage, using 4 threads, ~1,050 tries per second on a Core i3.)
Nmap has a MySQL attack script which cycles through common usernames.
On the same Core i3:
Statistics: Performed 50009 guesses in 9 seconds, average tps: 5556
Unless you intimately know the MySQL set-up on a remote server, some of MySQL's configuration can silently (and righteously) impede MySQL Brute.
First attempt to connect to a remote MySQL connection from the terminal (use any random input when prompted for password):
mysql -h <ip_addr> -u wordpress -pERROR 1045 (28000): Access denied for user 'wordpress'@'host' (using password: YES)
... shows MySQL is accepting remote user connections.
ERROR 2003 (HY000): Can't connect to MySQL server on 'host' (111)
... will be the bind address locked to localhost or a blocking firewall rule, or both.
bind-address = 127.0.0.1(my.cnf; if line present: comment out with#, then restart mysqld)skip-networking(my.cnf – disables TCP/IP; if line present, comment out with#, then restart mysqld)- firewall rules
mysql> SELECT host, user FROM mysql.user;
+-------------+------------+
| host | user |
+-------------+------------+
| localhost | wordpress |
| 10.0.0.% | xyz |
+-------------+------------+
... no remote connection permitted for user wordpress, but local network access for user xyz.
- mysqld can listen on a port other than 3306 (for port 3307, use
mysqlbrute ... -p 3307) - mysqld is down (on the server command-line, use:
pgrep mysql– no number output means mysqld is not running).
make deps && make && make install(Assumes libmysqlclient-dev and libssl-dev libraries are not installed.)
Ensure the libmysqlclient-dev and libssl-dev dependencies (from distro repo) are installed:
locate libmysqlclient-dev
locate libssl-devIf locate does not find each library, install on Debian-based distros with:
make depsor:
sudo apt install libmysqlclient-dev libssl-devIn the directory containing either the clone or the extracted zip files, compile with GCC:
makeor:
GCC:
gcc mysqlbrute.c $(mysql_config --cflags) $(mysql_config --libs) -o mysqlbrute -Ofast -Wall -Wextra -Wuninitialized -Wunused -Werror -std=gnu99 -sClang:
clang mysqlbrute.c $(mysql_config --cflags) $(mysql_config --libs) -o mysqlbrute -O3 -Wall -Wextra -Wuninitialized -Wunused -Werror -std=gnu99 -sDelete makefile and rename makefile_mariadb to makefile.
make deps && make && make installor:
sudo apt install libmariadb-dev libssl-dev
make(h0ek also specifies libmariadb-dev-compat as a dependency; in testing on Ubuntu 18.04 this library was not required for compilation, but it may well be in other scenarios.)
or:
GCC:
gcc mysqlbrute.c $(mariadb_config --cflags) $(mariadb_config --libs) -o mariabrute -Ofast -Wall -Wextra -Wuninitialized -Wunused -Werror -std=gnu99 -sMySQL Brute will rapidly enlarge the MySQL error log files:
- version 5.x – /var/log/mysql/error.log
- version 8 – /var/lib/mysql/<pc_name>.log (with
general_logvariable enabled)
(locations for Debian-based distros)
It may be more convenient for MySQL Brute to be available from any directory location via the $PATH system variable (rather than copying the executable file to the directory where needed).
make installOr move the mysqlbrute executable to a location such as /usr/local/bin (location must be present in $PATH).
- MMxM: slow Bash script that inspired.
- Vivek Gite: MySQL libraries compiling.
- Tim Čas: elegant EOL removal.
- Ben Alpert: microsecond timer.
MySQL Brute is released under the GPL v.3.
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent