search

Database Enumeration

hashtag
Basic DB Data Enumeration

Enumeration usually starts with the retrieval of the basic information:

  • Database version banner (switch --banner)

  • Current user name (switch --current-user)

  • Current database name (switch --current-db)

  • Checking if the current user has DBA (administrator) rights (switch --is-dba)

eldeim@htb[/htb]$ sqlmap -u "http://www.example.com/?id=1" --banner --current-user --current-db --is-dba

hashtag
Table Enumeration

eldeim@htb[/htb]$ sqlmap -u "http://www.example.com/?id=1" --tables -D testdb

...SNIP...
[13:59:24] [INFO] fetching tables for database: 'testdb'
Database: testdb
[4 tables]
+---------------+
| member        |
| data          |
| international |
| users         |
+---------------+

After spotting the table name of interest, retrieval of its content can be done by using the --dump option and specifying the table name with -T users, as follows:

hashtag
Table/Row Enumeration

To narrow down the rows based on their ordinal number(s) inside the table, we can specify the rows with the --start and --stop options (e.g., start from 2nd up to 3rd entry), as follows:

When dealing with large tables with many columns and/or rows, we can specify the columns (e.g., only name and surname columns) with the -C option, as follows:

hashtag
Conditional Enumeration

If there is a requirement to retrieve certain rows based on a known WHERE condition (e.g. name LIKE 'f%'), we can use the option --where, as follows:

hashtag
Full DB Enumeration

Instead of retrieving content per single-table basis, we can retrieve all tables inside the database of interest by skipping the usage of option -T altogether (e.g. --dump -D testdb). By simply using the switch --dump without specifying a table with -T, all of the current database content will be retrieved. As for the --dump-all switch, all the content from all the databases will be retrieved.

In such cases, a user is also advised to include the switch --exclude-sysdbs (e.g. --dump-all --exclude-sysdbs), which will instruct SQLMap to skip the retrieval of content from system databases, as it is usually of little interest for pentesters.

hashtag
PoCs - Questions

It is a basic injection, compared to the previous ones...

hashtag
DB Schema Enumeration

We could use the switch --schema:

hashtag
Searching for Data

We can search for databases, tables, and columns of interest, by using the --search option. This option enables us to search for identifier names by using the LIKE operator. For example, if we are looking for all of the table names containing the keyword user, we can run SQLMap as follows:

We could also have tried to search for all column names based on a specific keyword (e.g. pass):

hashtag
Password Enumeration and Cracking

Once we identify a table containing passwords (e.g. master.users), we can retrieve that table with the -T option, as previously shown:

hashtag
DB Users Password Enumeration and Cracking

To ease the whole process, SQLMap has a special switch --passwords designed especially for such a task:

Tip: The '--all' switch in combination with the '--batch' switch, will automa(g)ically do the whole enumeration process on the target itself, and provide the entire enumeration details.

hashtag
PoCs - Questions

  • 1 What's the name of the column containing "style" in it's name? (Case #1)

PreviousBuilding AttacksNextAdvanced SQLMap Usage

Last updated