There are several methods to obtain valid MySQL usernames. For example, web servers sometimes return database connection errors that reveal the MySQL username used by the web application. Penetration testers could use this information to perform brute force password auditing attacks and obtain access to sensitive information.
This recipe describes how to launch dictionary attacks against MySQL servers with Nmap.
To perform brute force password auditing against MySQL servers, use the following command:
$ nmap -p3306 --script mysql-brute <target>If valid credentials are found, they will be included in the mysql-brute output section:
3306/tcp open mysql | mysql-brute: | root:<empty> => Valid credentials |_ test:test => Valid credentials