MySQL Brute-Force
MySQL is a widely used relational database system, and its authentication layer is a common brute-force target when exposed to the network. This attack uses Hydra to test password combinations against the root account. Metasploit's mysql_login module was also attempted, but failed against this target — Metasploitable2 runs MySQL 5.0.51a, whose outdated authentication protocol the module cannot correctly parse. Hydra handles this legacy handshake correctly, making it the more reliable choice here.
Discovery
nmap -A -p- -T5 [target IP]Scans all ports with service versions and OS detection; MySQL (3306) is identified as open.
Attack
hydra -l root -P /usr/share/wordlists/mysql_password.txt mysql:// [target IP]Brute-forces the MySQL root password using Hydra, testing each password in the wordlist until a valid one is found.
Verification
mysql -h [target IP] -u root -p'[found password]' --skip-sslConnects to the MySQL service using the credential found by Hydra. The --skip-ssl flag is required because the outdated server doesn't support the modern client's default SSL handshake.
SELECT current_user();Confirms the connection was authenticated as root@% — root access from any host.
SELECT version();Displays the server version, confirming the outdated MySQL 5.0.51a build.
SHOW DATABASES;Lists accessible databases, including the mysql system database itself — exposing other accounts' credential hashes to a fully compromised administrator.