Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

There's more...

To enumerate databases if an empty root account is found, we can use the following command:

$ nmap -p3306 --script mysql-empty-password,mysql-databases <target>  

The script checking empty passwords will execute first, and if valid credentials are found, they will be used by the mysql-databases script:

   PORT     STATE SERVICE REASON    3306/tcp open  mysqlsyn-ack    | mysql-brute:     |   Accounts:     |     root:gusanito - Valid credentials    |_  Statistics: Performed 49994 guesses in 110 seconds, average tps:    521.3    | mysql-databases:     |   information_schema    |   mysql    |   performance_schema    |_  sys  

If the service is running on a port different than 3306, we can use Nmap's service detection (-sV) and set the port manually with the argument -p: