sqlmap1

Automatic sql injection tool

Usage

python3 sqlmap [options]

Overview

: ___

: __H__

___ ___[']_____ ___ ___: {1.7.10#stable}

|_ -| . [,] | .'| . | |___|_ [)]_|_|_|__,| _|

|_|V...: |_| https://sqlmap.org

Options

-h, --help: Show basic help message and exit

-hh: Show advanced help message and exit

--version: Show program's version number and exit

-v VERBOSE: Verbosity level: 0-6 (default 1)

: Target:

: At least one of these options has to be provided to define the target(s)

-u URL, --url=URL: Target URL (e.g. "http://www.site.com/vuln.php?id=1")

-g GOOGLEDORK: Process Google dork results as target URLs

: Request:

: These options can be used to specify how to connect to the target URL

--data=DATA: Data string to be sent through POST (e.g. "id=1")

--cookie=COOKIE: HTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")

--random-agent: Use randomly selected HTTP User-Agent header value

--proxy=PROXY: Use a proxy to connect to the target URL

--tor: Use Tor anonymity network

--check-tor: Check to see if Tor is used properly

: Injection:

: These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts

-p TESTPARAMETER: Testable parameter(s)

--dbms=DBMS: Force back-end DBMS to provided value

: Detection:

: These options can be used to customize the detection phase

--level=LEVEL: Level of tests to perform (1-5, default 1)

--risk=RISK: Risk of tests to perform (1-3, default 1)

: Techniques:

: These options can be used to tweak testing of specific SQL injection techniques

--technique=TECH..: SQL injection techniques to use (default "BEUSTQ")

: Enumeration:

: These options can be used to enumerate the back-end database management system information, structure and data contained in the tables

-a, --all: Retrieve everything

-b, --banner: Retrieve DBMS banner

--current-user: Retrieve DBMS current user

--current-db: Retrieve DBMS current database

--passwords: Enumerate DBMS users password hashes

--dbs: Enumerate DBMS databases

--tables: Enumerate DBMS database tables

--columns: Enumerate DBMS database table columns

--schema: Enumerate DBMS schema

--dump: Dump DBMS database table entries

--dump-all: Dump all DBMS databases tables entries

-D DB: DBMS database to enumerate

-T TBL: DBMS database table(s) to enumerate

-C COL: DBMS database table column(s) to enumerate

: Operating system access:

: These options can be used to access the back-end database management system underlying operating system

--os-shell: Prompt for an interactive operating system shell

--os-pwn: Prompt for an OOB shell, Meterpreter or VNC

: General:

: These options can be used to set some general working parameters

--batch: Never ask for user input, use the default behavior

--flush-session: Flush session files for current target

: Miscellaneous:

: These options do not fit into any other category

--wizard: Simple wizard interface for beginner users

History

Debian 13 (Trixie): the text shown here
Debian 12 (Bookworm) to Debian 11 (Bullseye)
Debian 10 (Buster) to Debian 9 (Stretch)
Debian 6.0 (Squeeze)

--all since Debian 9 (Stretch); --check-tor since Debian 9 (Stretch); --dbs since Debian 13 (Trixie); --flush-session since Debian 9 (Stretch); --level since Debian 9 (Stretch); --os-pwn since Debian 9 (Stretch); --random-agent since Debian 9 (Stretch); --risk since Debian 9 (Stretch); --schema since Debian 9 (Stretch); --technique since Debian 9 (Stretch); --tor since Debian 9 (Stretch); --wizard since Debian 9 (Stretch); -hh since Debian 9 (Stretch).

--alert until Debian 10 (Buster); --answers until Debian 10 (Buster); --auth-cred until Debian 10 (Buster); --auth-file until Debian 10 (Buster); --auth-type until Debian 10 (Buster); --beep until Debian 10 (Buster); --charset until Debian 10 (Buster); --cleanup until Debian 10 (Buster); --code until Debian 10 (Buster); --comments until Debian 10 (Buster); --common-columns until Debian 10 (Buster); --common-tables until Debian 10 (Buster); --cookie-del until Debian 10 (Buster); --count until Debian 10 (Buster); --crawl until Debian 10 (Buster); --crawl-exclude until Debian 10 (Buster); --csrf-token until Debian 10 (Buster); --csrf-url until Debian 10 (Buster); --csv-del until Debian 10 (Buster); --dbms-cred until Debian 10 (Buster); --delay until Debian 10 (Buster); --dependencies until Debian 10 (Buster); --disable-coloring until Debian 10 (Buster); --dns-domain until Debian 10 (Buster); --drop-set-cookie until Debian 10 (Buster); --dump-format until Debian 10 (Buster); --eta until Debian 10 (Buster); --eval until Debian 10 (Buster); --excl-reg until Debian 6.0 (Squeeze); --excl-str until Debian 6.0 (Squeeze); --exclude-sysdbs until Debian 10 (Buster); --file-dest until Debian 10 (Buster); --file-read until Debian 10 (Buster); --file-write until Debian 10 (Buster); --fingerprint until Debian 10 (Buster); --first until Debian 10 (Buster); --force-ssl until Debian 10 (Buster); --forms until Debian 10 (Buster); --fresh-queries until Debian 10 (Buster); --gpage until Debian 10 (Buster); --hea.. until Debian 10 (Buster); --headers until Debian 10 (Buster); --hex until Debian 10 (Buster); --host until Debian 10 (Buster); --hostname until Debian 10 (Buster); --hpp until Debian 10 (Buster); --identify-waf until Debian 10 (Buster); --ignore-401 until Debian 10 (Buster); --ignore-proxy until Debian 10 (Buster); --invalid-bignum until Debian 10 (Buster); --invalid-logical until Debian 10 (Buster); --invalid-string until Debian 10 (Buster); --is-dba until Debian 10 (Buster); --keep-alive until Debian 10 (Buster); --last until Debian 10 (Buster); --load-cookies until Debian 10 (Buster); --method until Debian 10 (Buster); --mobile until Debian 10 (Buster); --msf-path until Debian 10 (Buster); --no-cast until Debian 10 (Buster); --no-escape until Debian 10 (Buster); --not-string until Debian 10 (Buster); --null-connection until Debian 10 (Buster); --offline until Debian 10 (Buster); --os until Debian 10 (Buster); --os-bof until Debian 10 (Buster); --os-cmd until Debian 10 (Buster); --os-smbrelay until Debian 10 (Buster); --output-dir until Debian 10 (Buster); --page-rank until Debian 10 (Buster); --param-del until Debian 10 (Buster); --parse-errors until Debian 10 (Buster); --pivot-column until Debian 10 (Buster); --postfix until Debian 6.0 (Squeeze); --predict-output until Debian 10 (Buster); --prefix until Debian 10 (Buster); --priv-esc until Debian 10 (Buster); --privileges until Debian 10 (Buster); --proxy-cred until Debian 10 (Buster); --proxy-file until Debian 10 (Buster); --purge-output until Debian 10 (Buster); --randomize until Debian 10 (Buster); --read-file until Debian 6.0 (Squeeze); --referer until Debian 10 (Buster); --reg-add until Debian 10 (Buster); --reg-data until Debian 10 (Buster); --reg-del until Debian 10 (Buster); --reg-key until Debian 10 (Buster); --reg-read until Debian 10 (Buster); --reg-type until Debian 10 (Buster); --reg-value until Debian 10 (Buster); --regexp until Debian 10 (Buster); --retries until Debian 10 (Buster); --roles until Debian 10 (Buster); --safe-freq until Debian 10 (Buster); --safe-post until Debian 10 (Buster); --safe-req until Debian 10 (Buster); --safe-url until Debian 10 (Buster); --save until Debian 10 (Buster); --scope until Debian 10 (Buster); --search until Debian 10 (Buster); --second-order until Debian 10 (Buster); --shared-lib until Debian 10 (Buster); --skip until Debian 10 (Buster); --skip-static until Debian 10 (Buster); --skip-urlencode until Debian 10 (Buster); --skip-waf until Debian 10 (Buster); --smart until Debian 10 (Buster); --sql-file until Debian 10 (Buster); --sql-query until Debian 10 (Buster); --sql-shell until Debian 10 (Buster); --sqlmap-shell until Debian 12 (Bookworm); --stacked-test until Debian 6.0 (Squeeze); --start until Debian 10 (Buster); --stop until Debian 10 (Buster); --string until Debian 10 (Buster); --suffix until Debian 10 (Buster); --tamper until Debian 10 (Buster); --test-filter until Debian 10 (Buster); --test-skip until Debian 10 (Buster); --text-only until Debian 10 (Buster); --threads until Debian 10 (Buster); --time-sec until Debian 10 (Buster); --time-test until Debian 6.0 (Squeeze); --timeout until Debian 10 (Buster); --titles until Debian 10 (Buster); --tmp-path until Debian 10 (Buster); --tor-port until Debian 10 (Buster); --tor-type until Debian 10 (Buster); --udf-inject until Debian 10 (Buster); --union-char until Debian 10 (Buster); --union-cols until Debian 10 (Buster); --union-from until Debian 10 (Buster); --union-test until Debian 6.0 (Squeeze); --union-use until Debian 6.0 (Squeeze); --update until Debian 10 (Buster); --user-agent until Debian 10 (Buster); --users until Debian 10 (Buster); --where until Debian 10 (Buster); --write-file until Debian 6.0 (Squeeze); -H until Debian 10 (Buster); -U until Debian 10 (Buster); -X until Debian 10 (Buster); -c until Debian 10 (Buster); -d until Debian 10 (Buster); -f until Debian 10 (Buster); -l until Debian 10 (Buster); -m until Debian 10 (Buster); -o until Debian 10 (Buster); -r until Debian 10 (Buster); -s until Debian 10 (Buster); -t until Debian 10 (Buster); -x until Debian 10 (Buster); -z until Debian 10 (Buster).