Metasploit Revealed: Secrets of the Expert Pentester

Using file enumeration in MySQL using Metasploit

Metasploit offers the mysql_file_enum module to look for directories and files existing on the target. This module helps us figure out directory structures and the types of application running on the target's end. Let's see how we can run this module:

Primarily, we need to set the USERNAME, RHOSTS, and FILE_LIST parameters to make this module work on the target.

The FILE_LIST option will contain the path of the list of directories we want to check. We created a simple file at /root/desktop/ with the name file and put three entries in it, namely /var, /var/www, and /etc/passwd. Let's run the ...