fnmsd/MySQL_Fake_Server

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

1378 stars · 155 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A pure Python3 fake MySQL server used in penetration testing to exploit MySQL client file reading and trigger Java deserialization attacks against MySQL JDBC clients. It serves crafted responses based on the login username and integrates with ysoserial for payload generation.

Use cases

• read arbitrary files from MySQL clients via malicious server
• exploit MySQL JDBC client Java deserialization vulnerabilities
• test MySQL Connector/J autoDeserialize attack vectors
• capture files from tools like PHPMyAdmin or Navicat connecting to a fake MySQL server
• generate ysoserial payloads through JDBC connection strings
• simulate a malicious MySQL server during red team engagements

When to choose

• you are performing authorized penetration testing against MySQL clients
• you need to test whether a JDBC client is vulnerable to deserialization attacks
• you want a dependency-free Python tool for MySQL client file reading exploits

When to avoid

• you need a real MySQL database server
• you are not authorized to test the target systems
• you need a maintained tool with active support and a license

Facets

service · maturity maintenance

security networking developer-tools security penetration-testing databases developer-tools python cross-platform cli fake-server mysql penetration-testing file-reading java-deserialization jdbc-exploit red-team security-tools

Member repositories

For agents

markdown · JSON · MCP: product_card(name="fnmsd/MySQL_Fake_Server")