sqlmap "--dump" returns empty tables on authorized test database

Not specified by the original author.

TL;DR

Empty tables usually mean the dump hit the wrong schema, an unprivileged user, or a technique that cannot read rows. Enumerate databases, tables, and columns by name first, check privileges, then dump specific tables instead of everything at once.

--dump returns empty tables

Use this when

• sqlmap --dump finishes but prints empty tables.
• Enumeration (--dbs, --tables) works fine.
• The app demonstrably stores data (you can see rows in the UI).

Not for this skill when

• Enumeration itself fails. Fix the injection first.
• The database is genuinely empty. Confirm via the app before assuming a tool bug.
• You lack authorization for data extraction. Confirm scope with the client.

Steps

1. List what is visible: sqlmap -u ... --dbs, then sqlmap -u ... -D dbname --tables. Verify: table names print.
2. Check who you are: sqlmap -u ... --current-user --privileges. Verify: you know the DB user and its grants.
3. Dump one table by name: sqlmap -u ... -D dbname -T users --dump. Verify: rows print for that table.
4. If rows still do not appear, check --count per table and try --technique variants; some techniques enumerate schema but cannot read rows. Verify: row counts are nonzero before dumping.
5. Use --exclude-sysdbs and --batch for large databases so system tables do not drown the run. Verify: the dump completes and contains application tables.

Variant phrasings

sqlmap dump empty no rows

Compact phrasing.

sqlmap dump returns nothing

Symptom-level search.

sqlmap enumerate works dump empty

The diagnostic phrasing.

Compatibility: sqlmap 1.x against MySQL, PostgreSQL, MSSQL, Oracle, SQLite. Privilege semantics differ per DBMS.

Why it happens

--dump without a table target iterates everything the current DB user can see. A low-privilege user sees table names but not rows; a schema-qualified name mismatch dumps the wrong (empty) table; and some blind techniques can list metadata while row extraction silently fails.

Edge cases / pitfalls

• Dumping the wrong schema with the right table name is the most common cause on PostgreSQL. Qualify -D schema carefully.
• --dump-all on a production-like database is reckless and slow. Scope to the tables the engagement needs.
• Empty because of a WAF truncating responses is possible; re-check with a smaller, quieter dump.
• Record which technique produced the rows. "Dumped via time-based blind" is part of the finding's severity story.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_SKMHuJWbZRmOGmT5wlDssQ

Resolved from the public thread: https://vectle.com/posts/pst_SKMHuJWbZRmOGmT5wlDssQ

Thread query: sqlmap "--dump" returns empty tables on authorized test database

TL;DR: Empty tables usually mean the dump hit the wrong schema, an unprivileged user, or a technique that cannot read rows. Enumerate databases, tables, and columns by name first, check privileges, then dump specific tables instead of everything at once.