Wellcome To My Page Follow My Instagram.
πΈοΈ SQLMap Cheat Sheet
System Requirements for SQLMap
Running SQLMap
Password Cracking with SQLMap
Straightforward Method
--passwords option. SQLMap will first enumerate the users, then attempt to crack the password hashes.Indirect Method
users) because passwords likely reside there.1.
2.
Installation
Download Options
Basic Usage
Command Structure
Overview of SQL Injection Attacks
Attack Categories
1.
2.
3.
4.
In-Band (Classic) SQL Injection Attacks
Four Main Techniques (use --technique option)
1.
2.
3.
4.
Out-of-Band SQL Injection Attacks
Inferential (Blind) SQL Injection Attacks
Boolean Injections
/product/279/product/279' OR 1=11=1 always evaluates to TRUE, this reveals all products regardless of restrictions.Time Delay Injections (Time-based attacks)
Compound SQL Injection Attacks
SQLMap Options
Mandatory Arguments
| Option | Description |
|---|---|
-u URL, --url=URL | Target URL |
-l LOGFILE | Parse target(s) from Burp or WebScarab proxy log file |
-x SITEMAPURL | Parse target(s) from remote sitemap(.xml) file |
-m BULKFILE | Scan multiple targets given in textual file |
-r REQUESTFILE | Load HTTP request from file |
-g GOOGLEDORK | Process Google dork results as target URLs |
-c CONFIGFILE | Load options from configuration INI file |
General Options
| Option | Description |
|---|---|
-s SESSIONFILE | Load session from stored (.sqlite) file |
-t TRAFFICFILE | Log all HTTP traffic into textual file |
--batch | Never ask for user input, use default behavior |
--binary-fields=.. | Result fields having binary values |
--check-internet | Check Internet connection before assessing target |
--cleanup | Clean up the DBMS from sqlmap specific UDF and tables |
--crawl=CRAWLDEPTH | Crawl the website starting from target URL |
--crawl-exclude=.. | Regexp to exclude pages from crawling |
--csv-del=CSVDEL | Delimiting character used in CSV output |
--charset=CHARSET | Blind SQL injection charset |
--dump-format=.. | Format of dumped data |
--encoding=ENCODING | Character encoding used for data retrieval |
--eta | Display for each output the estimated time of arrival |
--flush-session | Flush session files for current target |
--forms | Parse and test forms on target URL |
--fresh-queries | Ignore query results stored in session file |
--har=HARFILE | Log all HTTP traffic into HAR file |
--hex | Use hex conversion during data retrieval |
--output-dir=OUTPUT.. | Custom output directory path |
--parse-errors | Parse and display DBMS error messages from responses |
--save=SAVECONFIG | Save options to configuration INI file |
--scope=SCOPE | Regexp to filter targets from provided proxy log |
--skip-urlencode | Skip URL encoding of payload data |
--skip-heuristics | Skip heuristic detection of vulnerabilities |
--skip-waf | Skip heuristic detection of WAF/IPS protection |
--table-prefix=.. | Prefix used for temporary tables |
--test-filter=.. | Select tests by payloads and/or titles |
--test-skip=.. | Skip tests by payloads and/or titles |
--web-root=WEBROOT | Web server document root directory |
Request Options
| Option | Description |
|---|---|
--data=DATA | Data string to be sent through POST |
--param-del=PARAM.. | Character used for splitting parameter values |
--cookie=COOKIE | HTTP Cookie header value |
--cookie-del=COOKIE.. | Character used for splitting cookie values |
--load-cookies=LOAD.. | File containing cookies in Netscape/wget format |
--drop-set-cookie | Ignore Set-Cookie header from response |
--user-agent=AGENT | HTTP User-Agent header value |
--random-agent | Use randomly selected HTTP User-Agent header |
--host=HOST | HTTP Host header value |
--referer=REFERER | HTTP Referer header value |
-H HEADER, --header=.. | Extra header (e.g. "X-Forwarded-For: 127.0.0.1") |
--headers=HEADERS | Extra headers (e.g. "Accept-Language: fr\nETag: 123") |
--auth-type=AUTH.. | HTTP authentication type |
--auth-cred=AUTH.. | HTTP authentication credentials |
--auth-file=AUTH.. | HTTP authentication PEM cert/private key file |
--ignore-code=IGNORE.. | Ignore (problematic) HTTP error code |
--ignore-proxy | Ignore system default proxy settings |
--ignore-redirects | Ignore redirection attempts |
--ignore-timeouts | Ignore connection timeouts |
--proxy=PROXY | Use proxy to connect to target URL |
--proxy-cred=PROXY.. | Proxy authentication credentials |
--proxy-file=PROXY.. | Load proxy list from file |
--tor | Use Tor anonymity network |
--tor-port=TORPORT | Set Tor proxy port other than default |
--tor-type=TORTYPE | Set Tor proxy type |
--check-tor | Check to see if Tor is used properly |
--delay=DELAY | Delay in seconds between each HTTP request |
--timeout=TIMEOUT | Seconds to wait before timeout connection |
--retries=RETRIES | Retries when connection times out |
--randomize=RPARAM | Randomly change value for given parameter(s) |
--safe-url=SAFEURL | URL address to visit frequently during testing |
--safe-post=SAFEPOST | POST data to send to safe URL |
--safe-req=SAFEREQ | Load safe HTTP request from file |
--safe-freq=SAFEFREQ | Test requests between visits to safe URL |
--skip-urlencode | Skip URL encoding of payload data |
--csrf-token=CSRF.. | Parameter used to hold anti-CSRF token |
--csrf-url=CSRFURL | URL address to visit for extraction of anti-CSRF token |
--csrf-method=CSRF.. | HTTP method to use during anti-CSRF token page visit |
--force-ssl | Force usage of SSL/HTTPS |
--chunked | Use HTTP chunked transfer encoded (POST) requests |
--hpp | Use HTTP parameter pollution method |
--eval=EVALCODE | Evaluate provided Python code before request |
Optimization Options
| Option | Description |
|---|---|
-o | Turn on all optimization switches |
--predict-output | Predict common queries output |
--keep-alive | Use persistent HTTP(s) connections |
--null-connection | Retrieve page length without actual HTTP response body |
--threads=THREADS | Max number of concurrent HTTP(s) requests (default 1) |
Injection Options
| Option | Description |
|---|---|
-p TESTPARAMETER | Testable parameter(s) |
--skip=SKIP | Skip testing for given parameter(s) |
--skip-static | Skip testing parameters that don't appear dynamic |
--param-exclude=.. | Regexp to exclude parameters from testing |
--param-filter=.. | Select testable parameter(s) by place |
--dbms=DBMS | Force back-end DBMS to provided value |
--dbms-cred=DBMS.. | DBMS authentication credentials |
--os=OS | Force back-end DBMS operating system |
--invalid-bignum | Use big numbers for invalidating values |
--invalid-logical | Use logical operations for invalidating values |
--invalid-string | Use random strings for invalidating values |
--no-cast | Turn off payload casting mechanism |
--no-escape | Turn off string escaping mechanism |
--prefix=PREFIX | Injection payload prefix string |
--suffix=SUFFIX | Injection payload suffix string |
--tamper=TAMPER | Use given script(s) for tampering injection data |
Detection Options
| Option | Description |
|---|---|
--level=LEVEL | Level of tests to perform (1-5, default 1) |
--risk=RISK | Risk of tests to perform (1-3, default 1) |
--string=STRING | String to match when query is evaluated to True |
--not-string=NOT.. | String to match when query is evaluated to False |
--regexp=REGEXP | Regexp to match when query is evaluated to True |
--code=CODE | HTTP code to match when query is evaluated to True |
--smart | Conduct thorough tests only if positive heuristic(s) |
--text-only | Compare pages based only on textual content |
--titles | Compare pages based only on their titles |
Techniques Options
| Option | Description |
|---|---|
--technique=TECH | SQL injection techniques to use (default "BEUSTQ") |
--time-sec=TIMESEC | Seconds to delay DBMS response (default 5) |
--union-cols=UCOLS | Range of columns to test for UNION query SQL injection |
--union-char=UCHAR | Character to use for bruteforcing number of columns |
--union-from=UFROM | Table to use in FROM part of UNION query SQL injection |
--dns-domain=DNS.. | Domain name used for DNS exfiltration attack |
--second-url=SECOND.. | Resulting page URL searched for second-order response |
--second-req=SECOND.. | Load second-order HTTP request from file |
Fingerprint Options
| Option | Description |
|---|---|
-f, --fingerprint | Perform an extensive DBMS version fingerprint |
Running a SQL Injection Attack Scan with SQLMap
Three Basic Steps
1.
2.
3.
Getting Database Information
List Databases and Tables
--dbs - Get a list of databases--tables - Get tables and their schema--schema - Get database schema--columns - Get column informationExample: Basic Database Enumeration
id parameter using cookie session to return database tables:Example: Column Enumeration
users table columns:Enumeration Options
| Option | Description |
|---|---|
-a, --all | Retrieve everything |
-b, --banner | Retrieve DBMS banner |
--current-user | Retrieve DBMS current user |
--current-db | Retrieve DBMS current database |
--hostname | Retrieve DBMS server hostname |
--is-dba | Detect if current user is DBA |
--users | Enumerate DBMS users |
--passwords | Enumerate DBMS users password hashes |
--privileges | Enumerate DBMS users privileges |
--roles | Enumerate DBMS users roles |
--dbs | Enumerate DBMS databases |
--tables | Enumerate DBMS database tables |
--columns | Enumerate DBMS database table columns |
--schema | Enumerate DBMS schema |
--count | Retrieve number of entries for table(s) |
--dump | Dump DBMS database table entries |
--dump-all | Dump all DBMS databases tables entries |
--search | Search column(s), table(s) and/or database name(s) |
--comments | Check for DBMS comments during enumeration |
--statements | Retrieve SQL statements being run on DBMS |
-D DB | DBMS database to enumerate |
-T TBL | DBMS database table(s) to enumerate |
-C COL | DBMS database table column(s) to enumerate |
-X EXCLUDE | DBMS database identifier(s) to not enumerate |
-U USER | DBMS user to enumerate |
--exclude-sysdbs | Exclude DBMS system databases when enumerating tables |
--pivot-column=P.. | Pivot column name |
--where=DUMPWHERE | Use WHERE condition while table dumping |
--start=LIMITSTART | First dump table entry to retrieve |
--stop=LIMITSTOP | Last dump table entry to retrieve |
--first=FIRSTCHAR | First query output word character to retrieve |
--last=LASTCHAR | Last query output word character to retrieve |
--sql-query=QUERY | SQL statement to be executed |
--sql-shell | Prompt for an interactive SQL shell |
--sql-file=SQLFILE | Execute SQL statements from given file(s) |
Brute Force Options
| Option | Description |
|---|---|
--common-tables | Check existence of common tables |
--common-columns | Check existence of common columns |
--common-files | Check existence of common files |
Password Cracking with Sqlmap Straightforward Method This requires read permissions on the target database. In
this case, you could enumerate the password hashes for each user with
the --passwordsoption. sqlmap will first enumerate the users, then
attempt to crack the password hashes.
Indirect Method
If your target database is sufficiently vulnerable, you can look for a
table containing user data (e.g., users) because passwords likely
reside there.Once sqlmap discovers a column of passwords, it will prompt you for
permission to crack the passwords, followed by a prompt on whether or
not to crack them via a dictionary-based attack. If the passwords are
sufficiently insecure, a βYβ to both prompts will yield meaningful
output passwords.
SQLMap Source Code Structure
Important SQLMap Directories
| Directory | Description |
|---|---|
/data/ | Contains wordlists, XML files, and other data files |
/extra/ | Contains extra tools and utilities |
/lib/ | Contains the core library files |
/plugins/ | Contains DBMS-specific plugins |
/tamper/ | Contains tamper scripts for bypassing filters |
/txt/ | Contains text files with common names, etc. |
/xml/ | Contains XML files with payloads and detection rules |
Test Levels and Risk Settings
Test Levels
--level values to dictate the volume of tests to perform:| Level | Description |
|---|---|
--level=1 | Limited number of tests (default) |
--level=2 | More tests including cookie testing |
--level=3 | Tests include User-Agent and Referer headers |
--level=4 | Tests include additional HTTP headers |
--level=5 | Maximum number of tests |
Risk Levels
--risk is the option to use:| Risk | Description |
|---|---|
--risk=1 | Default risk level |
--risk=2 | Adds heavy time-based SQL queries |
--risk=3 | Adds OR-based SQL injection queries |
Verbosity Levels
| Level | Description |
|---|---|
-v 0 | Show only Python tracebacks, error and critical messages |
-v 1 | Show also warning and info messages (default) |
-v 2 | Show also debug messages |
-v 3 | Show also payloads injected |
-v 4 | Show also HTTP requests |
-v 5 | Show also HTTP responses headers |
-v 6 | Show also HTTP responses page content |
Tamper Scripts
Useful Tamper Script Commands
| Script | Description |
|---|---|
--tamper=apostrophemask | Replaces apostrophe character with its UTF-8 full width counterpart |
--tamper=base64encode | Base64 encodes all characters in payload |
--tamper=between | Replaces greater than operator (>) with 'NOT BETWEEN 0 AND #' |
--tamper=charencode | URL-encodes all characters in payload |
--tamper=charunicodeencode | Unicode-URL-encodes all characters in payload |
Default Tamper Script Categories
1.
2.
3.
4.
Modified atΒ 2025-08-11 20:52:01