sqlmap --dbs returned no databases on authorized test app

TL;DR

An empty database list after a claimed injection usually means one of three things: the injection is blind and enumeration needs a working technique, the database account genuinely sees only one schema and enumeration is restricted, or the session is stale and requests are no longer authenticated. Prove the injection with a fingerprint first, then enumerate, and treat a verified restricted account as a finding, not a tool failure.

sqlmap --dbs returned no databases on authorized test app

Use this when

• sqlmap with the databases option returns an empty list on an authorized app where a parameter tested injectable.
• The app is known to have a database, so zero databases is not a plausible literal truth.

Not for this skill when

• Sqlmap never confirmed an injection on any parameter. There is nothing to enumerate yet.
• The target is a static or mocked test app with no real database behind it.

Steps

1. Re-confirm the injection on the exact parameter with a fingerprint run that reports the back-end database type. Verify: Verify: sqlmap names a DBMS, proving a live injection to enumerate through.
2. Check the session: reload the authorized app in the browser, confirm you are still logged in, and refresh any cookie sqlmap is using if the session expired. Verify: Verify: sqlmap requests return authenticated content, not login pages.
3. Ask for the current database and user through sqlmap, before listing all databases. Verify: Verify: a current database and user come back, showing what the account can see.
4. Enumerate again allowing blind techniques and enough time for character-by-character answers if the injection is blind. Verify: Verify: the database list returns, or the run shows steady blind progress rather than an instant empty result.
5. If enumeration still returns only the current schema, record it as privilege evidence: the app account appears limited to its own database. Verify: Verify: the finding cites the current user result and the empty enumeration together.

Variant phrasings

sqlmap injectable but dbs empty list

The contradiction phrasing.

sqlmap current-db works enumeration fails

The partial-success phrasing.

blind injection enumeration returns nothing sqlmap

The technique phrasing.

Compatibility: Compatibility: current sqlmap across common DBMS back ends; blind enumeration timing varies widely by technique.

Why it happens

Listing databases is a privileged catalogue read done through the injection. Blind channels can fail silently if timing is off, sessions can quietly expire so every query hits a login page, and a well-scoped application account may truly have no visibility beyond its own schema. Each cause looks identical from the empty list alone, which is why fingerprint and current-user checks come first.

Edge cases / pitfalls

• An instant empty result and a slow empty result mean different things; time the run before concluding.
• Do not escalate to operating system level options to fix an enumeration gap; that exceeds most web assessment scopes.
• If the account is restricted, that is a genuine positive security observation worth reporting as such.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_04lZ2AV9dUU4eAPMn3hpxA