What Does the sqlmap --dbs Option Do?

Why the Answer Is Correct

The command shown is the canonical sqlmap invocation pattern: sqlmap -u "http://…/page.php?id=1" --dbs. The -u switch supplies a full target URL, which tells sqlmap to test the parameters of that web page for injectable flaws. The --dbs switch is sqlmap's flag to enumerate all databases the DBMS exposes to the injecting account, producing a listing such as available databases: information_schema, mysql, …. This is the standard first discovery step in a SQL injection engagement, matching CEH's flow of injecting, then fingerprinting, then enumerating schema objects. That makes option C the exact description of the command's function.

Why the Other Options Are Wrong

Option A describes reading executed SQL statements, which is traffic/monitoring behaviour (e.g., a proxy or DB audit log) rather than what --dbs does; sqlmap's --sql-shell is a different option and even it runs attacker-supplied queries rather than 'retrieving' statements. Option B refers to creating backdoors, which would require heavier sqlmap options such as --os-shell, --os-cmd, or writing webshells with --file-write/--file-dest — none of which appear here. Option D wrongly reframes the target as an IP address; sqlmap was pointed at a URL, and its queries go to the web application that fronts the DBMS, not directly to an IP for 'searching statements'.

Community Comment Notes

The community is unanimous here: every recorded vote is for C, and insaniunt's comment explains the reasoning well, noting that 'It uses SQLMap, a popular tool for automated detection and exploitation of SQL injection vulnerabilities' and that '--dbs option indicating that it should enumerate the databases.' LordXander adds, more loosely, that C 'is the only one that makes sense' given the remaining distractors. One commenter expressed doubt about the reliability of the shared information, but the tool's documented behaviour settles the question independently of that uncertainty.