sqlmap
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers
Name:sqlmap
Category:Vulnerabilities
Publisher:trickest
Created:9/7/2021
Container:
quay.io/trickest/sqlmap:de66b69Output Type:
License:Unknown
Source:View Source
Parameters
--osForce back-end DBMS operating system to provided value--allRetrieve everything--dbsEnumerate DBMS databases--etaDisplay for each output the estimated time of arrival--hexUse hex conversion during data retrieval--hppUse HTTP parameter pollution method--torUse Tor anonymity network--urlTarget URL (e.g. http://www.site.com/vuln.php?id=1)--codeHTTP code to match when query is evaluated to True--dataData string to be sent through POST (e.g. id=1)--dbmsForce back-end DBMS to provided value--dumpDump DBMS database table entries--evalEvaluate provided Python code before the request (e.g. import hashlib;id2=hashlib.md5(id).hexdigest())--hostHTTP Host header value--lastLast query output word character to retrieve--riskRisk of tests to perform (1-3, default 1)--skipSkip testing for given parameter(s)--stopLast dump table entry to retrieve-UDBMS user to enumerate--alertRun host OS command(s) when SQL injection is found--countRetrieve number of entries for table(s)--crawlCrawl the website starting from the target URL--delayDelay in seconds between each HTTP request--firstFirst query output word character to retrieve--formsParse and test forms on target URL--gpageUse Google dork results from specified page number--levelLevel of tests to perform (1-5, default 1)--proxyUse a proxy to connect to the target URL--purgeSafely remove all content from sqlmap data directory--rolesEnumerate DBMS users roles--scopeRegexp for filtering targets--smartPerform thorough tests only if positive heuristic(s)--startFirst dump table entry to retrieve-TDBMS database table(s) to enumerate--usersEnumerate DBMS users--whereUse WHERE condition while table dumping--bannerRetrieve DBMS banner--base64Parameter(s) containing Base64 encoded data-CDBMS database table column(s) to enumerate--cookieHTTP Cookie header value (e.g. PHPSESSID=a8d127e..)--headerExtra header (e.g. X-Forwarded-For: 127.0.0.1)--is-dbaDetect if the DBMS current user is DBA--methodForce usage of given HTTP method (e.g. PUT)--mobileImitate smartphone through HTTP User-Agent header--os-bofStored procedure buffer overflow exploitation--os-cmdExecute an operating system command--os-pwnPrompt for an OOB shell, Meterpreter or VNC--prefixInjection payload prefix string--regexpRegexp to match when query is evaluated to True--repairRedump entries having unknown character marker (?)--schemaEnumerate DBMS schema--searchSearch column(s), table(s) and/or database name(s)--stringString to match when query is evaluated to True--suffixInjection payload suffix string--tablesEnumerate DBMS database tables--tamperUse given script(s) for tampering injection data--titlesCompare pages based only on their titles--answersSet predefined answers (e.g. quit=N,follow=N)--charsetBlind SQL injection charset (e.g. 0123456789abcdef)--chunkedUse HTTP chunked transfer encoded (POST) requests--cleanupClean up the DBMS from sqlmap specific UDF and tables--columnsEnumerate DBMS database table columns--csv-delDelimiting character used in CSV output (default ,)--headersExtra headers (e.g. Accept-Language: fr
ETag: 123)--no-castTurn off payload casting mechanism--offlineWork in offline mode (only use session data)--refererHTTP Referer header value--reg-addWrite a Windows registry key value data--reg-delDelete a Windows registry key value--reg-keyWindows registry key--retriesRetries when the connection timeouts (default 3)--threadsMax number of concurrent HTTP(s) requests (default 1)--timeoutSeconds to wait before timeout connection (default 30)--commentsCheck for DBMS comments during enumeration--csrf-urlURL address to visit for extraction of anti-CSRF token-DDBMS database to enumerate--dump-allDump all DBMS databases tables entries--encodingCharacter encoding used for data retrieval (e.g. GBK)--hostnameRetrieve DBMS server hostname-lParse target(s) from Burp or WebScarab proxy log file--os-shellPrompt for an interactive operating system shell--priv-escDatabase process user privilege escalation--reg-dataWindows registry key value data--reg-readRead a Windows registry key value--reg-typeWindows registry key value type--retry-onRetry request on regexp matching content (e.g. drop)--safe-reqLoad safe HTTP request from a file--safe-urlURL address to visit frequently during testing--skip-wafSkip heuristic detection of WAF/IPS protection--sql-fileExecute SQL statements from given file(s)--time-secSeconds to delay the DBMS response (default 5)--tmp-pathRemote absolute path of temporary files directory--tor-portSet Tor proxy port other than default--tor-typeSet Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))--unstableAdjust options for unstable connections--web-rootWeb server document root directory (e.g. /var/www)--auth-credHTTP authentication credentials (name:password)--auth-fileHTTP authentication PEM cert/private key file--auth-typeHTTP authentication type (Basic, Digest, Bearer, ...)-mScan multiple targets given in a textual file--check-torCheck to see if Tor is used properly--csrf-dataPOST data to send during anti-CSRF token page visit--dbms-credDBMS authentication credentials (user:password)--file-destBack-end DBMS absolute filepath to write to--file-readRead a file from the back-end DBMS file system--force-sslForce usage of SSL/HTTPS-zUse short mnemonics (e.g. flu,bat,ban,tec=EU)--no-escapeTurn off string escaping mechanism--param-delCharacter used for splitting parameter values (e.g. &)--passwordsEnumerate DBMS users password hashes--randomizeRandomly change value for given parameter(s)--reg-valueWindows registry key value--safe-freqRegular requests between visits to a safe URL--safe-postPOST data to send to a safe URL--sql-querySQL statement to be executed--sql-shellPrompt for an interactive SQL shell--techniqueSQL injection techniques to use (default BEUSTQ)--test-skipSkip tests by payloads and/or titles (e.g. BENCHMARK)--text-onlyCompare pages based only on the textual content-vVerbosity level: 0-6 (default 1)--abort-codeAbort on (problematic) HTTP error code(s) (e.g. 401)--cookie-delCharacter used for splitting cookie values (e.g. ;)--csrf-tokenParameter used to hold anti-CSRF token--current-dbRetrieve DBMS current database--dns-domainDomain name used for DNS exfiltration attack--file-writeWrite a local file on the back-end DBMS file system--keep-aliveUse persistent HTTP(s) connections--not-stringString to match when query is evaluated to False--preprocessUse given script(s) for preprocessing (request)--privilegesEnumerate DBMS users privileges--proxy-credProxy authentication credentials (name:password)--proxy-fileLoad proxy list from a file--proxy-freqRequests between change of proxy from a given list--second-reqLoad second-order HTTP request from file--second-urlResulting page URL searched for second-order response--shared-libLocal path of the shared library--statementsRetrieve SQL statements being run on DBMS--time-limitRun with a time limit in seconds (e.g. 3600)--udf-injectInject custom user-defined functions--union-charCharacter to use for bruteforcing number of columns--union-colsRange of columns to test for UNION query SQL injection--union-fromTable to use in FROM part of UNION query SQL injection--user-agentHTTP User-Agent header value--base64-safeUse URL and filename safe Base64 alphabet (RFC 4648)-cLoad options from a configuration INI file--csrf-methodHTTP method to use during anti-CSRF token page visit--dump-formatFormat of dumped data (CSV (default), HTML or SQLITE)--fingerprintPerform an extensive DBMS version fingerprint-gProcess Google dork results as target URLs--ignore-codeIgnore (problematic) HTTP error code(s) (e.g. 401)--os-smbrelayOne click prompt for an OOB shell, Meterpreter or VNC--postprocessUse given script(s) for postprocessing (response)--skip-staticSkip testing parameters that not appear to be dynamic--test-filterSelect tests by payloads and/or titles (e.g. ROW)--common-filesCheck existence of common files--csrf-retriesRetries for anti-CSRF token retrieval (default 0)--current-userRetrieve DBMS current user--ignore-proxyIgnore system default proxy settings--live-cookiesLive cookies file used for loading up-to-date values--load-cookiesFile containing cookies in Netscape/wget format-oTurn on all optimization switches--param-filterSelect testable parameter(s) by place (e.g. POST)--parse-errorsParse and display DBMS error messages from responses--pivot-columnPivot column name--random-agentUse randomly selected HTTP User-Agent header value-rLoad HTTP request from a file-sLoad session from a stored (.sqlite) file--table-prefixPrefix used for temporary tables (default: sqlmap)--union-valuesColumn values to use for UNION query SQL injection--binary-fieldsResult fields having binary values (e.g. digest)--common-tablesCheck existence of common tables--crawl-excludeRegexp to exclude pages from crawling (e.g. logout)--flush-sessionFlush session files for current target--fresh-queriesIgnore query results stored in session file--param-excludeRegexp to exclude parameters from testing (e.g. ses)--abort-on-emptyAbort data retrieval on empty results--check-internetCheck Internet connection before assessing the target--common-columnsCheck existence of common columns--exclude-sysdbsExclude DBMS system databases when enumerating tables--invalid-bignumUse big numbers for invalidating values--invalid-stringUse random strings for invalidating values--predict-outputPredict common queries output--skip-urlencodeSkip URL encoding of payload data--drop-set-cookieIgnore Set-Cookie header from response--ignore-timeoutsIgnore connection timeouts--invalid-logicalUse logical operations for invalidating values--null-connectionRetrieve page length without actual HTTP response body--skip-heuristicsSkip heuristic detection of vulnerabilities-pTestable parameter(s)--disable-coloringDisable console output coloring--ignore-redirectsIgnore redirection attempts-dConnection string for direct database connection-XDBMS database identifier(s) to not enumerate