A few questions for MySQL default login brute force scan

[Caratpine]

Hi team, here is my template

id: mysql-default-login
info:
    name: MySQL - Default Login
    author: DhiyaneshDk,pussycat0x,ritikchaddha
    severity: high
    description: |
        A MySQL service was accessed with easily guessed credentials.
    remediation: ""
    tags: js,mysql,default-login,network,fuzz,enum,http,javascript
    metadata:
      shodan-query: port:3306
      verified: true
javascript:
    - args:
        Host: '{{Host}}'
        Pass: '{{passwords}}'
        Port: '3306'
        User: '{{usernames}}'
      attack: clusterbomb
      code: |
        var m = require("nuclei/mysql");
        var c = m.MySQLClient();
        try {
          c.Connect(Host,Port,User,Pass);
        } catch (err) {
          log(err, User, Pass)
        }
      matchers:
        - condition: and
          dsl:
            - response == true
            - success == true
          type: dsl
      payloads:
        passwords: /Users/home/poc/helpers/wordlists/mysql-passwords.txt
        usernames: /Users/home/poc/helpers/wordlists/mysql-users.txt
      pre-condition: |
        isPortOpen(Host,Port);

My Nuclei scan command is

nuclei -target 127.0.0.1:3306 -t /Users/home/poc/mysql-default-login.yaml -include-tags fuzz --debug

Nuclei version: 3.2.9

Question 1: Dictionary path import

My templates are placed in a custom directory, and my dictionary file is imported through an absolute path. If I change the path to helpers/wordlists/mysql-passwords.txt, nuclei will not import the helpers directory under my directory, but will import the helpers directory under ~/nuclei-templates.

Question 2: Request timeout

When I run the Nuclei command, the context deadline exceeded occurs, and my log is supposed to print out the User and Pass values, but these values ​​are not printed out as expected.

[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => Error 1045 (28000): Acces .... .1' (using password: YES)
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded
[JS] 	1. value => [address=127.0.0.1:3306] context deadline exceeded

Question 3: {{Port}} replacement issue

I want to replace the value of the Port parameter in args from 3306 to {{Port}}. When running Nuclei, this error is reported
could not compile request: [mysql-default-login:RUNTIME] 'Port' variable cannot contain any dsl expressions

Could you help me answer the questions? Thanks!

[pussycat0x]

Hi @Caratpine I've made some modifications to your template — please find the updated version below.

Tested Nuclei Version : v3.4.2

id: mysql-default-login

info:
  name: MySQL - Default Login
  author: DhiyaneshDk,pussycat0x,ritikchaddha
  severity: high
  description: |
    A MySQL service was accessed with easily guessed credentials.
  metadata:
    verified: true
    max-request: 21
    shodan-query: "port:3306"
  tags: js,mysql,default-login,network,enum

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      var m = require("nuclei/mysql");
        var c = m.MySQLClient();
        try {
          c.Connect(Host,Port,User,Pass,pom);
        } catch (err) {
          log(`Error: ${err} - User: ${User}, Pass: ${Pass}`)
        }

    args:
      Host: "{{Host}}"
      pom: "{{port}}"
      User: "{{usernames}}"
      Pass: "{{passwords}}"

    threads: 10
    attack: clusterbomb
    payloads:
      usernames: /tmp/src/user.txt
      passwords: /tmp/src/pass.txt
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "response == true"
          - "success == true"
        condition: and

Answer for Question 1: Dictionary path import
Yes, we can use our own wordlist directory path in a Nuclei template. You can refer to the template above for an example.

    payloads:
      usernames: /tmp/src/user.txt
      passwords: /tmp/src/pass.txt

Answer for Question 2: Request timeout
Timeout:
Due to rate limiting, MySQL rejected multiple authenticated attempts.
print out the User and Pass values:
I have modified a Javascript Code to Print out the User and Pass Values

      var m = require("nuclei/mysql");
        var c = m.MySQLClient();
        try {
          c.Connect(Host,Port,User,Pass,pom);
        } catch (err) {
          log(`Error: ${err} - User: ${User}, Pass: ${Pass}`)
        }

Answer for Question 3: {{Port}} replacement issue
We can user {{Port}} Variable but Key and value shouldn't be same (Port: "{{port}}")

Example arg:

    args:
      Host: "{{Host}}"
      pom: "{{port}}"
      User: "{{usernames}}"
      Pass: "{{passwords}}"

I hope you found your answer! Feel free to reach out if you need anything related to Nuclei templates. Also, make sure to join our Discord community!

Debug Data

nuclei -u 192.168.1.2:3306  -t tmp-test.yaml

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.4.2

                projectdiscovery.io

[INF] Current nuclei version: v3.4.2 (latest)
[INF] Current nuclei-templates version: v10.2.0 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 268
[INF] Templates loaded for current scan: 1
[WRN] Loading 1 unsigned templates for scan. Use with caution.
[INF] Targets loaded for current scan: 1
[JS] Error: GoError: Error 1045 (28000): Access denied for user 'meow'@'172.17.0.1' (using password: YES) - User: meow, Pass: password
[mysql-default-login] [javascript] [high] 192.168.1.2:3306 [passwords="password",usernames="root"]
[mysql-default-login] [javascript] [high] 192.168.1.2:3306 [passwords="password",usernames="admin"]

[Caratpine]

Hi @pussycat0x thanks for your help, let me check!