Suppose I have a website which has SQL injection vulnerability and I got the database schema etc. Is there any means by which I can get the operating system username or the SSH username?

Asking from hardening purpose

1 Answer 1


Depends on the permissions given to the database user who you are acting as. If they have command execution privileges, it would be possible to use those to run a command such as id. Without that privilege, though, it is not supposed to be possible, but could be if the MySQL user was also a valid system user. In that case, it is possible to obtain the MySQL user through the user() function, which could then be used on the system, although these would not be the same entity (e.g. they could have distinct passwords)

  • user privilege is USAGE
    – Johnny
    May 4, 2016 at 9:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .