Use tooling to make enumeration faster, but keep the SQL primitives clear.
mysql CLI
Connect:
mysql -h HOST -u USER -p
Inline password in a lab:
mysql -h HOST -u USER -p'PASSWORD'
One-shot query:
mysql -h HOST -u USER -p'PASSWORD' -e "SELECT VERSION();"
Choose database:
mysql -h HOST -u USER -p'PASSWORD' -D DB
Save output:
mysql -h HOST -u USER -p'PASSWORD' -D DB -e "SELECT * FROM users;" > users.txt
mysqldump
Dump a database:
mysqldump -h HOST -u USER -p'PASSWORD' DB > dump.sql
Dump one table:
mysqldump -h HOST -u USER -p'PASSWORD' DB table_name > table.sql
mysqlsh / MySQLX
MySQL Shell can connect over MySQLX, commonly TCP 33060.
Run MySQL Shell in a disposable container:
sudo docker run -it --rm mysql/mysql-server mysqlsh
Connect:
\connect mysqlx://USERNAME@HOST:PORT
Example:
\connect mysqlx://172.16.1.19:33060
Exit:
\exit
Output Handling
Dump query output:
mysql -h HOST -u USER -p'PASSWORD' -D DB -e "SELECT * FROM users;" > users.txt
Grep results:
mysql -h HOST -u USER -p'PASSWORD' -D DB -e "SELECT * FROM users;" | grep admin
When output is messy, narrow the columns:
SELECT id, username, email FROM users LIMIT 20;