Use MySQL/MariaDB data and file primitives

Needs: Database authentication and exact schema/file privileges; secure_file_priv and server filesystem identity constrain file actions

Shell commands

# Baseline
mysql -h TARGET -P PORT -u USER -p

SQL commands

-- Baseline
SELECT VERSION(), USER(), CURRENT_USER();
SHOW DATABASES;
SHOW GRANTS;
USE DATABASE;
SHOW TABLES;
DESCRIBE TABLE;
SELECT * FROM TABLE LIMIT 20;
SELECT @@secure_file_priv;

-- MySQL variant — validate server-side file read/write prerequisites
SELECT LOAD_FILE('/path/on/database/server');
SELECT 'probe' INTO OUTFILE '/allowed/server/path/probe.txt';

Interpret: USER() shows the presented client identity; CURRENT_USER() shows the account used for privilege checking. secure_file_priv restricts server-side import/export: a directory constrains it, an empty value is unrestricted by that variable, and NULL disables these operations. The FILE privilege is still required.

Use only an authorized harmless path. LOAD_FILE returning NULL is ambiguous among missing file, permissions, size, FILE privilege and secure_file_priv. INTO OUTFILE will not overwrite an existing file. A written file becomes execution only if another privileged component consumes it.

Verify → Check current database identity, grants and actual returned data or written file through an independent observation.

If it fails → Permission denied or a restricted file directory changes the available primitive; pivot to data/credential use or a different entry point. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
Confirmed SQL control plus database file, execution or impersonation privileges → Convert database rights into a file or operating-system effect
Needs: DBMS-specific privilege and enabled facility; OS service identity, writable/readable destination and a compatible consumer
Uploads are retrievable and the application stack suggests an executable file handler → Execute an uploaded file through a compatible handler
Needs: Controlled executable content survives validation; final storage/URL is handled by the compatible interpreter; process execution is permitted

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use MySQL/MariaDB data and file primitives

USE WHEN: A MySQL-compatible service and valid application/database credentials
STARTING ACCESS: A confirmed reachable application; anonymous context or one identified credential
RESULT: Useful data or a permission-backed server-side file operation

Recognize the clue

Use a known application/database login and inspect identity, grants and file-operation constraints before choosing an OS transition.

SELECT USER(),CURRENT_USER(),VERSION();
SHOW GRANTS;
SHOW VARIABLES LIKE 'secure_file_priv';

SYNTHETIC EXAMPLE OUTPUT

CURRENT_USER(): APP_USER@%
GRANT SELECT ON APP_DB.*
secure_file_priv: /RESTRICTED_DIRECTORY/

Means: SELECT permits data investigation; absent FILE/admin rights and the restricted directory constrain file/OS hypotheses.

Confirm: Check exact grants, useful tables, destination OS permissions and an execution consumer before escalating a file operation.

After validation: A useful readable table or fully validated file consumer exists: choose that precise primitive.
Ruled out in this context: No required FILE privilege rules out the proposed LOAD_FILE/OUTFILE chain for this account.
Still inconclusive: Incomplete grants or unknown server path keeps file capability unresolved; inspect before selecting it.

Troubleshooting: Permission denied or a restricted file directory changes the available primitive; pivot to data/credential use or a different entry point.

Interpret: USER() shows the presented client identity; CURRENT_USER() shows the account used for privilege checking. secure_file_priv restricts server-side import/export: a directory constrains it, an empty value is unrestricted by that variable, and NULL disables these operations. The FILE privilege is still required.

MySQL variant — validate server-side file read/write prerequisites

Use only an authorized harmless path. LOAD_FILE returning NULL is ambiguous among missing file, permissions, size, FILE privilege and secure_file_priv. INTO OUTFILE will not overwrite an existing file. A written file becomes execution only if another privileged component consumes it.

Why it works

Database rights and operating-system rights intersect. FILE permission alone does not guarantee a writable executable web directory or a usable destination.

Worked example · hypothetical

Observation: the application database login can read configuration tables. Test: inspect grants before any file operation. Illustrative output: no FILE privilege. Interpretation: use data/credential disclosure; do not assume server execution.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗