---
description: Contains the details of the topic Web Attacks/SQLi/Tools/sqlmap.
---

# sqlmap

[sqlmap](https://github.com/sqlmapproject/sqlmap)

```bash
sqlmap -u <URL?id=val>            # GET
sqlmap -u <URL> --data=<id=val>   # POST
```

## Options

<table data-header-hidden><thead><tr><th width="212"></th><th width="594"></th></tr></thead><tbody><tr><td><code>-u</code></td><td>Specify URL.<br><code>sqlmap -u &#x3C;URL></code></td></tr><tr><td><code>--data</code></td><td>Specifies POST parameters</td></tr><tr><td><code>-p</code></td><td><p>Specifies the parameter to be tested, otherwise by default it tests all of them.<br>Possible to also use <code>*</code> at the end of the parameter.<br><code>sqlmap -u &#x3C;URL?id=val&#x26;name=test> -p id</code> </p><p><code>sqlmap -u &#x3C;URL?id=val*&#x26;name=test></code></p></td></tr><tr><td><code>-r</code></td><td>Specifies a file containing the request to be used.<br>Possible to get it from BurpSuite with <code>Copy to file</code>.<br><code>sqlmap -r &#x3C;REQUEST.TXT></code></td></tr><tr><td><code>-v</code></td><td>Verbosity level: <code>0-6</code></td></tr><tr><td><code>-t</code></td><td>Stores traffic (requests and responses).<br><code>-t &#x3C;FILE_OUTPUT></code></td></tr><tr><td><code>--force-ssl</code></td><td>Use HTTPS</td></tr><tr><td><code>-H</code></td><td>Specific headers.<br><code>-H 'Cookie:PHPSESSID=ABC'</code></td></tr><tr><td><code>--cookie</code></td><td>Specify the cookie (the one in the <code>Cookie</code> field).<br><code>--cookie='PHPSESSID=ABC'</code></td></tr><tr><td><code>-A</code></td><td>Specify User-agent. Better use: <br><code>--random-agent</code> : Generates real random User-agent <br><code>--mobile</code> : Generates User-agent of a smartphone</td></tr><tr><td><code>--proxy</code></td><td>Specify proxy.<br><code>--proxy "http://127.0.0.1:8080"</code></td></tr><tr><td><code>--flush-session</code></td><td>To delete session data.</td></tr><tr><td><code>--threads</code></td><td>Specify threads, from <code>1</code> to <code>10</code> (default <code>1</code>).</td></tr><tr><td><mark style="color:green;"><code>--technique</code></mark></td><td>Specify the technique: <code>BEUSTQ</code> <em>(See</em> <a href="#techniques"><em>Techniques</em></a><em>)</em><br><code>--technique=BEU</code></td></tr><tr><td><code>--union-cols</code></td><td>Specifies the number of columns to be used for the Union technique. Also possible to specify a range. To be tested as it may not work without it.<br><code>--union-cols=5</code> <br><code>--union-cols=5-10</code></td></tr><tr><td><code>--union-char</code></td><td>Specifies the value to use in the columns for Union, if the standard ones in sqlmap do not fit (NULL and numbers)<br><code>--union-char='a'</code></td></tr><tr><td><mark style="color:red;"><code>--level</code></mark></td><td>Increases vectors and boundaries.<br>Default level <code>1</code> but ranges from <code>1-5</code>. <br><code>2</code> = CookieHeader<br><code>3</code> = User-agent/ReferrerHeaders</td></tr><tr><td><mark style="color:red;"><code>--risk</code></mark></td><td><p>Specify risk level, which payloads to use.<br>Default level <code>1</code> but ranges from <code>1-3</code>.<br><code>2</code> = Time-basedHeavy</p><p><code>3</code> = OR-based (dangerous in update query).</p></td></tr><tr><td><code>--prefix</code></td><td>Prefix to the payloads to be correct, specify boundaries.<br><code>--prefix “%'))”</code> <em>(these is already presen</em>t)</td></tr><tr><td><code>--suffix</code></td><td>Suffixes to the payloads to be correct, specify boundaries.<br><code>--suffix “-- -”</code> <em>(these is already presen</em>t)</td></tr><tr><td><code>--string</code></td><td>Specify <code>true condition</code>.<br>String that is always present on output pages true.<br><code>--string “good”</code></td></tr><tr><td><code>--not-string</code></td><td><p>Specify the <code>false condition</code>.</p><p>String that is always present in output pages false.<br><code>--not-string “bad”</code></p></td></tr><tr><td><code>--text-only</code></td><td>If there are a lot of dynamic elements such as <code>&#x3C;script></code>, <code>&#x3C;style></code>, <code>&#x3C;meta></code>, etc. you can tell SQLmap not to consider them for true and false condition, but rely only on the visible text.</td></tr><tr><td><code>--titles</code></td><td>Specify to consider the <code>&#x3C;title></code> tag for the true and false condition.</td></tr><tr><td><code>--dbms</code></td><td>Specify the dbms that the server is using (if sqlmap misdetects or fails).</td></tr><tr><td><code>--parse-errors</code></td><td>To automatically print DBMS error, for error analysis.</td></tr><tr><td><code>--banner</code></td><td>Banner Grabbing.</td></tr><tr><td><code>--hostname</code></td><td>Target hostname.</td></tr><tr><td><mark style="color:yellow;"><code>--current-user</code></mark></td><td>Current user.</td></tr><tr><td><mark style="color:yellow;"><code>--is-dba</code></mark></td><td>If the user is a database administrator.</td></tr><tr><td><mark style="color:yellow;"><code>--current-db</code></mark></td><td>Current database.</td></tr><tr><td><mark style="color:yellow;"><code>--users</code></mark></td><td>List users.</td></tr><tr><td><mark style="color:yellow;"><code>--passwords</code></mark></td><td>To obtain passwords hashes.</td></tr><tr><td><mark style="color:yellow;"><code>--dbs</code></mark></td><td>List of accessible databases.</td></tr><tr><td><mark style="color:yellow;"><code>-D</code></mark></td><td>Select database.</td></tr><tr><td><mark style="color:yellow;"><code>--tables</code></mark></td><td>List of tables in the selected database.</td></tr><tr><td><mark style="color:yellow;"><code>-T</code></mark></td><td>Select table.</td></tr><tr><td><mark style="color:yellow;"><code>--columns</code></mark></td><td>List columns, attributes.</td></tr><tr><td><mark style="color:yellow;"><code>-C</code></mark></td><td>Select column.</td></tr><tr><td><mark style="color:yellow;"><code>--dump</code></mark></td><td>Retrieve data from the selected column.<br><code>--dump -T &#x3C;TABLE></code> <em>(the whole table)</em><br><code>--dump -D &#x3C;DATABASE></code> <em>(the whole db)</em></td></tr><tr><td><mark style="color:yellow;"><code>--where</code></mark></td><td>Specify a condition, ex. <code>ID=4</code> <em>(w</em>ith <code>--dump</code>)<br><code>--where="name LIKE 'f%'"</code></td></tr><tr><td><mark style="color:yellow;"><code>--schema</code></mark></td><td>View the schema, the structure of the tables.</td></tr><tr><td><code>--dump-all</code><br><code>--exclude-sysdbs</code></td><td>Specifies to dump the contents of all databases.<br>The second specifies to skip system databases.<br><code>--dump-all --exclude-sysdbs</code></td></tr><tr><td><code>--search</code></td><td><p>Lets you search databases, tables, or columns.<br><code>--search &#x3C;WHERE> &#x3C;STRING></code><br><code>--search -T user</code> <em>(table names with user)</em></p><p><code>--search -C pass</code> <em>(column names with pass)</em></p></td></tr><tr><td><code>--csrf-token</code></td><td>Specifies the CSRF token to be processed in requests.<br>By default tries to identify those containing <code>csrf</code>, <code>xsrf</code>, <code>token</code>.<br><code>--csrf-token=”&#x3C;NOME_TOKEN_CSRF>”</code></td></tr><tr><td><code>--randomize</code></td><td>Unique values may be requested instead of the CSRF token. Allows random values to be generated for the specified parameter.<br><code>--randomize=”&#x3C;PARAM>”</code></td></tr><tr><td><code>--eval</code></td><td>Specify operations to be done in python on parameters before the request, useful for bypassing some control mechanisms such as <code>h=MD5(id)</code>.<br>If <code>http://&#x3C;IP>/?id=1&#x26;h=??</code>:<br><code>--eval="import hashlib; h=hashlib.md5(id).hexdigest()"</code></td></tr><tr><td><code>--tor</code><br><code>--check-tor</code></td><td><p>To use the tor proxy for requests. Adding <code>--check-tor</code> performs verification by sending a request to <em>https://check.torproject.org/</em><br><code>--tor</code> </p><p><code>--tor --check-tor</code></p></td></tr><tr><td><code>--skip-waf</code></td><td>If we want to skip WAF detection in the initial part to generate less noise.</td></tr><tr><td><mark style="color:blue;"><code>--tamper</code></mark></td><td>Allows you to specify Scripts that are applied to requests before they are sent. These scripts make changes to requests to bypass WAFs. You can also specify more than one, the order is not important because priority is established internally in sqlmap.<br><code>--tamper=&#x3C;TAMPER1>,&#x3C;TAMPER2></code><br><code>--tamper=between</code></td></tr><tr><td><mark style="color:blue;"><code>--list-tampers</code></mark></td><td>To view the tamper list and description <em>(see</em> <a href="#tamper"><em>Tampers</em></a><em>)</em>.</td></tr><tr><td><code>--file-read</code></td><td>If you have the necessary privileges (most likely if you are DBA) we can read a file by specifying its path.<br><code>--file-read="&#x3C;PATH>"</code></td></tr><tr><td><code>--file-write</code><br><code>--file-dest</code></td><td>If you have necessary privileges (not only DBA but also where to write etc.) we can write a given file with <code>--file-write</code> to a destination specified with <code>--file-dest</code>.<br><code>--file-write &#x3C;FILE> --file-dest &#x3C;DEST></code></td></tr><tr><td><code>--keep-alive</code></td><td>Establish permanent connection for faster data dumping.</td></tr><tr><td><code>--os-cmd</code></td><td>To execute a command. See <a href="">SQLi</a>.</td></tr><tr><td><code>--os-shell</code></td><td>To get interactive shell (needs minimum write permissions). Try specifying different techniques. See <a href="">SQLi</a>.</td></tr><tr><td><code>--web-root</code></td><td>Specify where to save the files for interactive shell or other, it must be a writable folder.</td></tr><tr><td><code>--batch</code></td><td>If there are any requests/questions during the program sqlmap, with this flag we are telling it to always use the default answers, useful for long processes.</td></tr></tbody></table>

## <mark style="color:green;">Techniques</mark>

* `B`: Boolean-based blind
* `E`: Error-based
* `U`: Union query-based
* `S`: Stacked queries
* `T`: Time-based blind
* `Q`: Inline queries

## <mark style="color:blue;">Tampers</mark>

<table><thead><tr><th width="302">Tamper-Script</th><th>Description</th></tr></thead><tbody><tr><td><code>0eunion</code></td><td>Replaces instances of UNION with e0UNION</td></tr><tr><td><code>base64encode</code></td><td>Base64-encodes all characters in a given payload</td></tr><tr><td><code>between</code></td><td>Replaces greater than operator (<code>></code>) with <code>NOT BETWEEN 0 AND #</code> and equals operator (<code>=</code>) with <code>BETWEEN # AND #</code></td></tr><tr><td><code>commalesslimit</code></td><td>Replaces (MySQL) instances like <code>LIMIT M, N</code> with <code>LIMIT N OFFSET M</code> counterpart</td></tr><tr><td><code>equaltolike</code></td><td>Replaces all occurrences of operator equal (<code>=</code>) with <code>LIKE</code> counterpart</td></tr><tr><td><code>halfversionedmorekeywords</code></td><td>Adds (MySQL) versioned comment before each keyword</td></tr><tr><td><code>modsecurityversioned</code></td><td>Embraces complete query with (MySQL) versioned comment</td></tr><tr><td><code>modsecurityzeroversioned</code></td><td>Embraces complete query with (MySQL) zero-versioned comment</td></tr><tr><td><code>percentage</code></td><td>Adds a percentage sign (<code>%</code>) in front of each character (e.g. SELECT -> %S%E%L%E%C%T)</td></tr><tr><td><code>plus2concat</code></td><td>Replaces plus operator (<code>+</code>) with (MsSQL) function CONCAT() counterpart</td></tr><tr><td><code>randomcase</code></td><td>Replaces each keyword character with random case value (ex. SELECT -> SEleCt)</td></tr><tr><td><code>space2comment</code></td><td>Replaces space character ( ) with comments `/</td></tr><tr><td><code>space2dash</code></td><td>Replaces space character ( ) with a dash comment (<code>--</code>) followed by a random string and a new line (<code>\n</code>)</td></tr><tr><td><code>space2hash</code></td><td>Replaces (MySQL) instances of space character ( ) with a pound character (<code>#</code>) followed by a random string and a new line (<code>\n</code>)</td></tr><tr><td><code>space2mssqlblank</code></td><td>Replaces (MsSQL) instances of space character ( ) with a random blank character from a valid set of alternate characters</td></tr><tr><td><code>space2plus</code></td><td>Replaces space character ( ) with plus (<code>+</code>)</td></tr><tr><td><code>space2randomblank</code></td><td>Replaces space character ( ) with a random blank character from a valid set of alternate characters</td></tr><tr><td><code>symboliclogical</code></td><td>Replaces AND and OR logical operators with their symbolic counterparts (<code>&#x26;&#x26;</code> and <code>||</code>)</td></tr><tr><td><code>versionedkeywords</code></td><td>Encloses each non-function keyword with (MySQL) versioned comment</td></tr><tr><td><code>versionedmorekeywords</code></td><td>Encloses each keyword with (MySQL) versioned comment</td></tr></tbody></table>

## Payloads

{% code overflow="wrap" %}
```bash
sqlmap -u <target> --dbs
```
{% endcode %}

{% code overflow="wrap" %}
```bash
sqlmap -u <target> -D <database> --tables
```
{% endcode %}

{% code overflow="wrap" %}
```bash
sqlmap -u <target> -D <database> -T <table> --columns
```
{% endcode %}

{% code overflow="wrap" %}
```bash
sqlmap -u <target> -D <database> -T <table> -C <column1,column2> --dump
```
{% endcode %}
