Database Ports Explained: MySQL, MSSQL & Exposed Databases (Animated)

Behind almost every website is a database. Apps connect to it over its own protocol: MySQL on 3306, Microsoft SQL Server on 1433, PostgreSQL on 5432, MongoDB on 27017, Redis on 6379. Databases should only ever be reachable by the apps that need them; every year, thousands of breaches come from databases left open to the internet.

1. Connect & log in: the app logs in to the database

The database server greets the client with its version and a random salt; the app answers with its username and a password hash response.

1. GREETING (Database server → Web app server): The greeting reveals the exact version, which scanners collect.
2. LOGIN (Web app server → Database server): The app logs in with its own limited account.
3. OK (Database server → Web app server): Connected.

Wireshark filter:

mysql

2. Run a query: sql in, rows out

Every page view becomes one or more SQL queries.

1. QUERY (Web app server → Database server): A parameterised query: user input is never glued into the SQL text.
2. RESULT (Database server → Web app server): The rows come back and the page is built.

Wireshark filter:

mysql.query

3. Exposed database: attack: the database answers the whole internet

A firewall mistake or a cloud setting puts port 3306 on the internet. Automated scanners find it within hours and try default and common passwords; once in, they copy or delete the data and often leave a ransom note.

1. LOGIN (Attacker → Database server): Automated login attempts arrive from the internet.
2. OK (Database server → Attacker): One works.
3. QUERY (Attacker → Database server): The data is copied out: a reportable breach.

Wireshark filter:

tcp.dstport == 3306 && !(ip.src == 10.0.1.10)

4. Lock it down: defence: private network, firewall, least privilege

Bind the database to a private address, allow only the app server through the firewall, require TLS, remove default accounts, give the app a least-privilege account, and alert on logins from unknown sources.

1. SYN (Attacker → Database server): From outside, the port simply isn’t there.
2. QUERY (Web app server → Database server): The app keeps working as before.

My.cnf + firewall:

bind-address = 10.0.1.20
require_secure_transport = ON
Allow TCP 3306 only from 10.0.1.10

FAQ