Sqlmap Cheat Sheet: Commands and Flags

sqlmap is a penetration testing tool for SQL injection (SQLi). It automates the detection and exploitation of SQLi flaws and database server hijacking. This makes penetration testing much more efficient, but sqlmap’s vast documentation can make learning sqlmap a daunting task. A mini-reference would help you focus on essential commands.

On top of that, a bird’s-eye view of how you conduct your penetration tests helps you to prioritize your computing resources. It’s undesirable to drown in the technical minutiae trying to locate the right commands to issue.

This cheat sheet is the mini-reference for sqlmap learners of all stages, and it provides the bird’s-eye view you need to build your testing strategy. The latter is especially crucial when Google Dorking (mentioned below) as you must stay within query limits; redundant queries can cause your IP address to be blacklisted.

You may download the PDF version of this cheat sheet here.

System Requirements for Sqlmap

sqlmap runs on Python versions 2.6, 2.7, and 3 on Windows, macOS, and Linux.

From this point onward, we will simply use sqlmap to represent any of these choices:

• python sqlmap.py
• python3 sqlmap.py
• py -2 sqlmap.py
• py -3 sqlmap.py
• (Kali Linux) sqlmap

Check that you have the correct Python versions installed in your command line console or terminal using sqlmap --version.

Install Sqlmap

Download sqlmap below:

• tarball here;
• zipball here.
• cloning the Git repository:
  git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

This is also the preferred method to upgrade sqlmap on Kali Linux.

The Git wiki has information for advanced sqlmap users.

Checking for SQLi Vulnerabilities

How to use sqlmap in the command line:

sqlmap [mandatory arguments and values required] [options and values where applicable]

Overview of SQLi Attacks

Categories of SQLi attacks include:

• In-band
• Out-of-band
• Inferential (or Blind)
• Compound

In-Band (or Classic) SQLi Attacks

In in-band attacks, the attacker can launch the attack and view results through the same channel (band), such as via a console shell or web application. The four most popular in-band injection techniques are error-based, union-based, stacked queries, and inline queries. (sqlmap option: --technique)

Error-based injections

Error messages displayed in the console or application leak information about the database configurations, structure, and data.

Union-based injections

Using UNION and associated keywords, the attacker combines the results from a legitimate query with those from an attack to extract data, such as by matching user data with location history.

Stacked queries (piggybacking)

The attacker sends multiple SQL statements joined by a semicolon in the same call to the database server to change the data within or manipulate the server.

Inline queries

Embedding partial SQL statements on the server-side backend makes the server vulnerable to SQLi via client-side input.

Out-of-Band SQLi Attacks

Out-of-band attacks obtain data using a channel (band) other than the one making the request. Examples include receiving an email containing query results and sending results to a different web server using a separate HTTP connection.

Inferential (or Blind) SQLi Attacks

These involve changing the database behavior to reconstruct information.

Boolean injections

This inferential attack involves Boolean expressions, such as tautologies. If you are visiting an e-commerce website, you might obtain a product page via the route /product/279, which translates to this query string in the backend:

SELECT * FROM products WHERE id='279';

But append a tautological statement to the route to get /product/279'%20or%201=1:

SELECT * FROM products WHERE id='279' OR 1=1;

Since 1=1 must evaluate to TRUE, you can see all products regardless of the limitations the vendor has placed on them, such as unannounced or out-of-stock inventory.

Time delay injections (time-based attacks)

This inferential attack leaves negligible traces of penetration on the database logs during the exploration of an unknown database. Such attacks depend on the database pausing for a fixed time before responding, and the injected time delay command differs across SQL languages.

If the database is not vulnerable to a time-based attack, the results will load quickly despite the time delay specified.

Compound SQLi Attacks

Compound SQLi attacks refer to SQLi attacks plus other cyberattacks, such as unauthorized access, distributed denial of service (DDoS), domain name server (DNS) hijacking, and cross-site scripting (XSS). The details of the other attacks are beyond the scope of this cheat sheet.

Sqlmap Options

Mandatory Arguments

At least one of the following is necessary for the sqlmap command to run:

General Options

Set general working parameters.

Request Options

Specify how to connect to the target URL.

Optimization Options

Optimize the performance of sqlmap.

Injection Options

Specify the parameters to test against, custom injection payloads, and optional tampering scripts.

Customize the detection phase of the SQL attack scan.

Techniques Options

Tweak testing of specific SQLi techniques.

Fingerprint Option

Assess a database before attacking it.

Running a SQLi Attack Scan with Sqlmap

Three basic steps underlie a SQLi attack scan:

1. Conduct reconnaissance on a database using mandatory target arguments and fingerprinting.
2. Discover potential vulnerabilities by enumerating the database contents.
3. Run tests of different SQLi attacks to determine the extent of these vulnerabilities.

Repeat steps 2-3 to your satisfaction.

Get a List of Databases on Your System and Their Tables

Use enumeration options to scan SQL databases. To get a list of databases on your system, use --dbs. For the tables and their schema, use --tables, --schema, and --columns.

Below is an example of exploiting a vulnerability in the id parameter in a given cookie session to return the database tables (--tables) using default answers to prompts (--batch):

sqlmap -u "http://sometestdb.to/view?id=123&Submit=Submit#" --cookie="PHPSESSID=e3f9231953973ace4acb63cfde2ccc08; security=low" --tables --batch

To narrow down the exploit to the users column, use the --columns option followed by -T and the desired table name:

sqlmap -u "http://sometestdb.to/view?id=123&Submit=Submit#" --cookie="PHPSESSID=e3f9231953973ace4acb63cfde2ccc08; security=low" --columns -T users --batch

Enumeration Options

These options can be used to enumerate the configuration information, structure and data contained in the tables of the target database management system.

Brute Force Options

Guess whether the database contains common names for tables, columns, and files.

Password Cracking with Sqlmap

Straightforward Method

This requires read permissions on the target database. In this case, you could enumerate the password hashes for each user with the --passwords option. sqlmap will first enumerate the users, then attempt to crack the password hashes.

Indirect Method

If your target database is sufficiently vulnerable, you can look for a table containing user data (e.g., users) because passwords likely reside there.

Once sqlmap discovers a column of passwords, it will prompt you for permission to crack the passwords, followed by a prompt on whether or not to crack them via a dictionary-based attack. If the passwords are sufficiently insecure, a “Y” to both prompts will yield meaningful output passwords.

Sqlmap's Source Code Structure and How to Navigate It

View the source code of sqlmap here on GitHub. Click here for a high-resolution version of the diagram.

Important and Useful Sqlmap Directories

You may customize your sqlmap experience by adding or editing files in the following directories. GitHub links refer to directories found in the sqlmap source code.

Test --levels and Their Impact on Your Commands

Check your database against particular SQLi attacks by setting test --level values to dictate the volume of tests to perform and the degree of feedback from sqlmap.

sqlmap SQLi payloads are usually harmless, but if you want to test your database to breaking point, --risk is the option to use:

Verbosity Levels

These integer levels (0-6) are for troubleshooting and to see what sqlmap is doing under the hood.

Tamper Scripts and Their Actions

Tamper scripts are for bypassing security controls, such as Web Application Firewalls (WAFs) and Intrusion Prevention Systems. There are at least 60 scripts by default, but you can add custom ones.

Useful tamper script commands:

Default tamper script actions fall into four categories:

We hope this sqlmap cheat sheet makes sqlmap a more enjoyable experience for you. To download a PDF version of this sqlmap cheat sheet, click here.

Frequently Asked Questions

Level Up in Cyber Security: Join Our Membership Today!

MEMBERSHIP