Skip to content
attack.paths
Iniciar sesión
← RegistryDossier · 8 steps · 7 edges

SQLi (UNION) → DB dump → admin login

Discover a UNION-based SQL injection on a search/listing endpoint, enumerate the schema, dump the users table, and authenticate as an admin.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: web app uses raw string concatenation for at least one SQL query. The DB role has read access to the users table. No WAF or a bypassable one.

§ Steps

  1. 01
    Authenticate as adminInitial Access
    T1078— Valid Accounts
  2. 02
    Crack password hashes offlineCredential Access
    T1110— Brute Force
  3. 03
    Map the app & find injectable paramsReconnaissance
    W-RECON-DIRBRUTE— Directory & File Bruteforce
  4. 04
    Fingerprint the stack & DBReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting

    Banner, error messages, DB-specific sleep functions.

  5. 05
    Plant a backdoor admin accountPersistence
    W-ADMIN-PERSIST— Backdoor Admin Account
  6. 06
    Dump users tableCollection
    W-SQLI-UNION— SQL Injection — UNION-Based

    Include password hash + role columns.

  7. 07
    Enumerate schema (information_schema)Collection
    W-SQLI-UNION— SQL Injection — UNION-Based
  8. 08
    Confirm UNION-based SQLiCollection
    W-SQLI-UNION— SQL Injection — UNION-Based

    ORDER BY N to count columns, then UNION SELECT 1,2,…

§ References

§ Frequently asked

What is the "SQLi (UNION) → DB dump → admin login" attack path?
Discover a UNION-based SQL injection on a search/listing endpoint, enumerate the schema, dump the users table, and authenticate as an admin. It chains 8 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Authenticate as admin (T1078) — a initial access primitive. Assumed environment: web app uses raw string concatenation for at least one SQL query.
What is the final impact of this kill-chain?
The final step lands on Confirm UNION-based SQLi (W-SQLI-UNION), which falls under Collection. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

SQLi (UNION) → DB dump → admin login | Attack Paths