3

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the table:

Table: sqlmapoutput
[0 entries]
+------+
| data |
+------+
+------+

On checking I found that there was a boolean-based blind sqli in his site. So if his site was breached why will someone leave this table there? Is there any reason for something like sqlmap to create something like this?

PS: No need to explain other issues, and just focus on the presence of this table plz.

Improve this question

2 Answers 2

Reset to default
3

This is the result of someone running sqlmap on the database. (Specifically here) Either this is

  • An honest pentester:

    In this case, delete the table and fix whatever vulnerability they discovered.

  • Some other actor:

    Consider all data comprimised. Search for whatever hole caused this and fix it, and if you have users force them all to reset their passwords.

Improve this answer
1
  • I understand that side of the issue @shelvacu. I have already found and patched an sql injection on the website. Now is there a reason for that table's presence in the database? sqlmap, by default, doesn't create any tables in the db. could the attacker have created the table for something else? like, and i'm just feeling the field here, some kind of script that runs on the server side which sends the data in the table automatically to the attackers ip? or for combining all the data in other tables and storing it there for some reason?
    – mystupidstory
    Jan 5, 2016 at 18:29
0

If he has no idea how it got there, then there's a problem: one of his input fields is likely vulnerable to SQL injection attacks. You'll need to track down the culprits.

I have my doubts that this is the result of an honest pentester, it sounds more like a script kiddie. However, shelvacu is right. You should consider all data to be compromised.

Improve this answer
1
  • again, my focus is not on the vulnerability, but the presence of the table. check my comment on the upvoted answer @Mark Buffalo
    – mystupidstory
    Jan 5, 2016 at 18:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .