{
  "port": 3306,
  "protocol": "tcp",
  "service": "MySQL / MariaDB",
  "oneLiner": "MySQL and MariaDB client protocol, TCP 3306.",
  "whatItIs": "The mysqld and mariadbd servers accept client connections on TCP 3306 by default; the client protocol carries queries, results, and authentication handshakes. Which interfaces it binds depends on bind_address — MySQL defaults to * (all interfaces), while distro-packaged MariaDB commonly ships 127.0.0.1. A server that greets you here identifies itself with its version string in the initial handshake packet before you authenticate. It shows up on scans of application servers, container hosts, and anything that bundled a database with a web app.",
  "exposure": {
    "verdict": "never",
    "note": "A database port on the internet is a credential-guessing and CVE target with the whole dataset behind it — bind it to localhost or a private network and reach it over a VPN or SSH tunnel."
  },
  "checkCommand": "mysql -h DB_HOST -P 3306 -u someuser -p -e 'SELECT VERSION();'",
  "links": [
    {
      "title": "MySQL 8.4 Reference Manual — Connecting to the MySQL Server",
      "url": "https://dev.mysql.com/doc/refman/8.4/en/connecting.html",
      "kind": "official-docs"
    },
    {
      "title": "MySQL 8.4 Reference Manual — bind_address system variable",
      "url": "https://dev.mysql.com/doc/refman/8.4/en/server-system-variables.html",
      "kind": "official-docs"
    },
    {
      "title": "MariaDB — Configuring MariaDB for Remote Client Access",
      "url": "https://mariadb.com/kb/en/configuring-mariadb-for-remote-client-access/",
      "kind": "official-docs"
    },
    {
      "title": "MySQL Server (GitHub)",
      "url": "https://github.com/mysql/mysql-server",
      "kind": "github"
    }
  ]
}