I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns information_schema database.

Is there something wrong (if so, is there anything I can do to circumvent it ?) or the database really only has 1 database ?


it is unlikely that the web application you are testing only has the one database as information_schema is read-only metadata.

you can dump some of the views in there to find out if there are other databases that you aren't allowed to see for some reason:

information_schema.schemata is the table (it is really a view) you would want to dump.

edit: can you explain what you are trying to do with your --tamper and --data statements

  • The site is behind Cloudflare, hence the "between,randomcase,space2comment" tamper, the "id" is the vulnerable parameter. Also I tried to "inject" (I dont know the correct term) the mysql.innodb_table_stats, and yes it returns another database which is not listed in sqlmap --dbs option. Jul 27 '20 at 7:46
  • I also tried to do inject another system database which is not listed by --dbs command, I tried to do -D mysql -T user --columns, and it does returns some columns. Do you know what configuration caused this kind of behaviour? Jul 27 '20 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.