audit-labs/audit-tools
A collection of scripts, queries, and other goodies you can use in an audit.
clone: git clone https://gitbay.org/audit-labs/audit-tools.git
main: databases/mysql/README.md · raw
1# `mysql_admins.sql`
2
3``` sql
4SELECT * FROM information_schema.user_privileges;
5```
6
7 MySQL [(none)]> SELECT * FROM information_schema.user_privileges;
8 +--------------------------------+---------------+---------------------------------+--------------+
9 | GRANTEE | TABLE_CATALOG | PRIVILEGE_TYPE | IS_GRANTABLE |
10 +--------------------------------+---------------+---------------------------------+--------------+
11 | 'mysql.infoschema'@'localhost' | def | SELECT | NO |
12 | 'mysql.infoschema'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO |
13 | 'mysql.infoschema'@'localhost' | def | FIREWALL_EXEMPT | NO |
14 | 'mysql.infoschema'@'localhost' | def | SYSTEM_USER | NO |
15 | 'mysql.session'@'localhost' | def | SHUTDOWN | NO |
16 | 'mysql.session'@'localhost' | def | SUPER | NO |
17 | 'mysql.session'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO |
18 | 'mysql.session'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | NO |
19 | 'mysql.session'@'localhost' | def | BACKUP_ADMIN | NO |
20 | 'mysql.session'@'localhost' | def | CLONE_ADMIN | NO |
21 | 'mysql.session'@'localhost' | def | CONNECTION_ADMIN | NO |
22 | 'mysql.session'@'localhost' | def | FIREWALL_EXEMPT | NO |
23 | 'mysql.session'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | NO |
24 | 'mysql.session'@'localhost' | def | SESSION_VARIABLES_ADMIN | NO |
25 | 'mysql.session'@'localhost' | def | SYSTEM_USER | NO |
26 | 'mysql.session'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | NO |
27 | 'mysql.sys'@'localhost' | def | USAGE | NO |
28 | 'mysql.sys'@'localhost' | def | AUDIT_ABORT_EXEMPT | NO |
29 | 'mysql.sys'@'localhost' | def | FIREWALL_EXEMPT | NO |
30 | 'mysql.sys'@'localhost' | def | SYSTEM_USER | NO |
31 | 'root'@'localhost' | def | SELECT | YES |
32 | 'root'@'localhost' | def | INSERT | YES |
33 | 'root'@'localhost' | def | UPDATE | YES |
34 | 'root'@'localhost' | def | DELETE | YES |
35 | 'root'@'localhost' | def | CREATE | YES |
36 | 'root'@'localhost' | def | DROP | YES |
37 | 'root'@'localhost' | def | RELOAD | YES |
38 | 'root'@'localhost' | def | SHUTDOWN | YES |
39 | 'root'@'localhost' | def | PROCESS | YES |
40 | 'root'@'localhost' | def | FILE | YES |
41 | 'root'@'localhost' | def | REFERENCES | YES |
42 | 'root'@'localhost' | def | INDEX | YES |
43 | 'root'@'localhost' | def | ALTER | YES |
44 | 'root'@'localhost' | def | SHOW DATABASES | YES |
45 | 'root'@'localhost' | def | SUPER | YES |
46 | 'root'@'localhost' | def | CREATE TEMPORARY TABLES | YES |
47 | 'root'@'localhost' | def | LOCK TABLES | YES |
48 | 'root'@'localhost' | def | EXECUTE | YES |
49 | 'root'@'localhost' | def | REPLICATION SLAVE | YES |
50 | 'root'@'localhost' | def | REPLICATION CLIENT | YES |
51 | 'root'@'localhost' | def | CREATE VIEW | YES |
52 | 'root'@'localhost' | def | SHOW VIEW | YES |
53 | 'root'@'localhost' | def | CREATE ROUTINE | YES |
54 | 'root'@'localhost' | def | ALTER ROUTINE | YES |
55 | 'root'@'localhost' | def | CREATE USER | YES |
56 | 'root'@'localhost' | def | EVENT | YES |
57 | 'root'@'localhost' | def | TRIGGER | YES |
58 | 'root'@'localhost' | def | CREATE TABLESPACE | YES |
59 | 'root'@'localhost' | def | CREATE ROLE | YES |
60 | 'root'@'localhost' | def | DROP ROLE | YES |
61 | 'root'@'localhost' | def | ALLOW_NONEXISTENT_DEFINER | YES |
62 | 'root'@'localhost' | def | APPLICATION_PASSWORD_ADMIN | YES |
63 | 'root'@'localhost' | def | AUDIT_ABORT_EXEMPT | YES |
64 | 'root'@'localhost' | def | AUDIT_ADMIN | YES |
65 | 'root'@'localhost' | def | AUTHENTICATION_POLICY_ADMIN | YES |
66 | 'root'@'localhost' | def | BACKUP_ADMIN | YES |
67 | 'root'@'localhost' | def | BINLOG_ADMIN | YES |
68 | 'root'@'localhost' | def | BINLOG_ENCRYPTION_ADMIN | YES |
69 | 'root'@'localhost' | def | CLONE_ADMIN | YES |
70 | 'root'@'localhost' | def | CONNECTION_ADMIN | YES |
71 | 'root'@'localhost' | def | CREATE_SPATIAL_REFERENCE_SYSTEM | YES |
72 | 'root'@'localhost' | def | ENCRYPTION_KEY_ADMIN | YES |
73 | 'root'@'localhost' | def | FIREWALL_EXEMPT | YES |
74 | 'root'@'localhost' | def | FLUSH_OPTIMIZER_COSTS | YES |
75 | 'root'@'localhost' | def | FLUSH_PRIVILEGES | YES |
76 | 'root'@'localhost' | def | FLUSH_STATUS | YES |
77 | 'root'@'localhost' | def | FLUSH_TABLES | YES |
78 | 'root'@'localhost' | def | FLUSH_USER_RESOURCES | YES |
79 | 'root'@'localhost' | def | GROUP_REPLICATION_ADMIN | YES |
80 | 'root'@'localhost' | def | GROUP_REPLICATION_STREAM | YES |
81 | 'root'@'localhost' | def | INNODB_REDO_LOG_ARCHIVE | YES |
82 | 'root'@'localhost' | def | INNODB_REDO_LOG_ENABLE | YES |
83 | 'root'@'localhost' | def | OPTIMIZE_LOCAL_TABLE | YES |
84 | 'root'@'localhost' | def | PASSWORDLESS_USER_ADMIN | YES |
85 | 'root'@'localhost' | def | PERSIST_RO_VARIABLES_ADMIN | YES |
86 | 'root'@'localhost' | def | REPLICATION_APPLIER | YES |
87 | 'root'@'localhost' | def | REPLICATION_SLAVE_ADMIN | YES |
88 | 'root'@'localhost' | def | RESOURCE_GROUP_ADMIN | YES |
89 | 'root'@'localhost' | def | RESOURCE_GROUP_USER | YES |
90 | 'root'@'localhost' | def | ROLE_ADMIN | YES |
91 | 'root'@'localhost' | def | SENSITIVE_VARIABLES_OBSERVER | YES |
92 | 'root'@'localhost' | def | SERVICE_CONNECTION_ADMIN | YES |
93 | 'root'@'localhost' | def | SESSION_VARIABLES_ADMIN | YES |
94 | 'root'@'localhost' | def | SET_ANY_DEFINER | YES |
95 | 'root'@'localhost' | def | SHOW_ROUTINE | YES |
96 | 'root'@'localhost' | def | SYSTEM_USER | YES |
97 | 'root'@'localhost' | def | SYSTEM_VARIABLES_ADMIN | YES |
98 | 'root'@'localhost' | def | TABLE_ENCRYPTION_ADMIN | YES |
99 | 'root'@'localhost' | def | TELEMETRY_LOG_ADMIN | YES |
100 | 'root'@'localhost' | def | TRANSACTION_GTID_TAG | YES |
101 | 'root'@'localhost' | def | XA_RECOVER_ADMIN | YES |
102 | 'cmc'@'%' | def | USAGE | NO |
103 +--------------------------------+---------------+---------------------------------+--------------+
104 92 rows in set (0.001 sec)
105
106# `passwords.sql`
107
108``` sql
109SELECT user, host, plugin FROM mysql.user;
110```
111
112 mysql> SELECT user, host, plugin FROM mysql.user;
113 +------------------+-----------+-----------------------+
114 | user | host | plugin |
115 +------------------+-----------+-----------------------+
116 | cmc | % | caching_sha2_password |
117 | mysql.infoschema | localhost | caching_sha2_password |
118 | mysql.session | localhost | caching_sha2_password |
119 | mysql.sys | localhost | caching_sha2_password |
120 | root | localhost | caching_sha2_password |
121 +------------------+-----------+-----------------------+
122 5 rows in set (0.001 sec)
123
124``` sql
125SHOW GLOBAL VARIABLES LIKE 'validate_password%';
126SHOW VARIABLES LIKE 'validate_password%';
127```
128
129 mysql> SHOW GLOBAL VARIABLES LIKE 'validate_password%';
130 +-------------------------------------------------+--------+
131 | Variable_name | Value |
132 +-------------------------------------------------+--------+
133 | validate_password.changed_characters_percentage | 0 |
134 | validate_password.check_user_name | ON |
135 | validate_password.dictionary_file | |
136 | validate_password.length | 8 |
137 | validate_password.mixed_case_count | 1 |
138 | validate_password.number_count | 1 |
139 | validate_password.policy | MEDIUM |
140 | validate_password.special_char_count | 1 |
141 +-------------------------------------------------+--------+
142 8 rows in set (0.004 sec)
143
144 mysql> SHOW VARIABLES LIKE 'validate_password%';
145 +-------------------------------------------------+--------+
146 | Variable_name | Value |
147 +-------------------------------------------------+--------+
148 | validate_password.changed_characters_percentage | 0 |
149 | validate_password.check_user_name | ON |
150 | validate_password.dictionary_file | |
151 | validate_password.length | 8 |
152 | validate_password.mixed_case_count | 1 |
153 | validate_password.number_count | 1 |
154 | validate_password.policy | MEDIUM |
155 | validate_password.special_char_count | 1 |
156 +-------------------------------------------------+--------+
157 8 rows in set (0.004 sec)
158
159``` sql
160SELECT * FROM mysql.user
161```
162
163 MySQL [(none)]> SELECT * FROM mysql.user;
164 +-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+------------------------------------------------------------------------+------------------+-----------------------+-------------------+----------------+------------------+----------------+------------------------+---------------------+--------------------------+-----------------+
165 | Host | User | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin | authentication_string | password_expired | password_last_changed | password_lifetime | account_locked | Create_role_priv | Drop_role_priv | Password_reuse_history | Password_reuse_time | Password_require_current | User_attributes |
166 +-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+------------------------------------------------------------------------+------------------+-----------------------+-------------------+----------------+------------------+----------------+------------------------+---------------------+--------------------------+-----------------+
167 | % | cmc | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | | N | 2025-04-25 16:28:52 | NULL | N | N | N | NULL | NULL | NULL | NULL |
168 | localhost | mysql.infoschema | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED | N | 2025-04-25 15:51:53 | NULL | Y | N | N | NULL | NULL | NULL | NULL |
169 | localhost | mysql.session | N | N | N | N | N | N | N | Y | N | N | N | N | N | N | N | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED | N | 2025-04-25 15:51:53 | NULL | Y | N | N | NULL | NULL | NULL | NULL |
170 | localhost | mysql.sys | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | $A$005$THISISACOMBINATIONOFINVALIDSALTANDPASSWORDTHATMUSTNEVERBRBEUSED | N | 2025-04-25 15:51:53 | NULL | Y | N | N | NULL | NULL | NULL | NULL |
171 | localhost | root | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | | | | 0 | 0 | 0 | 0 | caching_sha2_password | | N | 2025-04-25 15:51:53 | NULL | N | Y | Y | NULL | NULL | NULL | NULL |
172 +-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------+-------------+--------------+---------------+-------------+-----------------+----------------------+-----------------------+------------------------------------------------------------------------+------------------+-----------------------+-------------------+----------------+------------------+----------------+------------------------+---------------------+--------------------------+-----------------+
173 5 rows in set (0.005 sec)