Dumper

The Dumper works with supported database-injection findings to inspect and, where explicitly authorized, retrieve selected database content. It automates a stage of a penetration test that must remain tightly scoped because it can access sensitive data.

What It Does

• Tests candidate URLs for supported injection methods.
• Identifies accessible database structures.
• Uses presets to select matching columns and avoid unrelated data.
• Can filter targets by row count, country, rank, or traffic.
• Can send permitted hash results to the Dehasher when Auto Dehash is enabled.

What You Can Use It For

• Confirming the impact of an SQL injection in an authorized assessment.
• Demonstrating that a specific, approved data class is exposed.
• Reviewing schemas before making a narrow export with DB Explorer.
• Verifying that a remediation prevents the previously authorized access.

Typical Input and Output

Input: confirmed or suspected injectable URLs, extraction presets, limits, and an approved data scope.

Output: injection status, database metadata, and only the rows or columns selected by your presets.

When to Choose It

Use the Dumper only after a scanner or manual review has identified a database-related issue and your written authorization permits impact validation. Discovery alone is not permission to access data. Prefer the smallest proof necessary, minimize collection, and handle every result as sensitive.

Use Dumper & DB Explorer for the workflow, Dumper Presets for selective matching, and Task Settings for performance controls.