“The interaction between MySQL clients and the server defaults to port 3306. If explicitly exposed to an untrusted network, an attacker can directly authenticate to the server to execute tasks like querying and updating core relational data.”
Somebody needed to connect Workbench from their laptop, once, in 2019. They edited mysqld.cnf, restarted the service, it worked, and nobody revisited it. That is the origin story of most exposed MySQL instances, and Penetration Testing MySQL is a walk-through of what an attacker does with them — no SQL injection required, because the database is answering the network directly.
Locating the Target
The manual starts on the parameter that decides everything: bind-address. MySQL’s packaged default is 127.0.0.1, which accepts connections only from the host itself — the local Apache or PHP-FPM process and nothing else.
Change it to 0.0.0.0, or comment it out, and the daemon now listens on every interface the machine has. The guide shows the discovery side with nmap -p3306 -sV, which also fingerprints the fork and version from the banner. One point worth carrying into an internal assessment: containerised MySQL frequently bypasses this reasoning altogether, because Docker’s port publishing writes its own iptables rules and a -p 3306:3306 on a container is reachable regardless of what the host firewall claims to be doing.
Authentication and Privilege Escalation
An open port is a starting position, not a finding. The guide moves into authentication — Hydra and Metasploit modules against common root passwords, which works about as often as it does because database credentials are rotated approximately never and appear in configuration files nobody audits.
The more interesting section is the GRANT architecture, because MySQL’s access model is a pair rather than a name. 'root'@'localhost' and 'root'@'%' are two distinct accounts and may have entirely different passwords. A grant like GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' authorises administrative access from any source address on the internet, and it is exactly the command a tutorial will tell a frustrated developer to run when a remote connection is refused. The trade-off statement the guide could make more forcefully: tightening these host specifications to real subnets is correct and will break connections whose origin nobody has documented, so the migration is a discovery exercise before it is a security one.
Who Is This Book REALLY For?
- Database administrators: A clear demonstration of what a wildcard
%host actually authorises, and why the account you created for one laptop is now a permanent external attack surface. - Infrastructure testers: The Nmap and Metasploit workflow for discovering, classifying and compromising exposed instances on an internal network.
- DevSecOps teams: The argument for restricting the listener at deployment time. Treat the suggestion of a non-default port as friction rather than security —
nmap -sVfinds MySQL on 33060 in the same pass, and moving the port mostly succeeds in confusing your own monitoring.
The Bottom Line
Penetration Testing MySQL makes the case efficiently: a hardened web application in front of a database that accepts connections from anywhere is not a defended architecture. It is a well-guarded front door on a building with the side gate propped open, and the attacker was never going to use the door.
