sqlmap
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers
Details
Category: Vulnerabilities
Publisher: trickest
Created Date: 9/7/2021
Container: quay.io/trickest/sqlmap:de66b69
Source URL: https://github.com/sqlmapproject/sqlmap
Parameters
Command:
--os - Force back-end DBMS operating system to provided valueCommand:
--all - Retrieve everythingCommand:
--dbs - Enumerate DBMS databasesCommand:
--eta - Display for each output the estimated time of arrivalCommand:
--hex - Use hex conversion during data retrievalCommand:
--hpp - Use HTTP parameter pollution methodCommand:
--tor - Use Tor anonymity networkCommand:
--url - Target URL (e.g. http://www.site.com/vuln.php?id=1)Command:
--code - HTTP code to match when query is evaluated to TrueCommand:
--data - Data string to be sent through POST (e.g. id=1)Command:
--dbms - Force back-end DBMS to provided valueCommand:
--dump - Dump DBMS database table entriesCommand:
--eval - Evaluate provided Python code before the request (e.g. import hashlib;id2=hashlib.md5(id).hexdigest())Command:
--host - HTTP Host header valueCommand:
--last - Last query output word character to retrieveCommand:
--risk - Risk of tests to perform (1-3, default 1)Command:
--skip - Skip testing for given parameter(s)Command:
--stop - Last dump table entry to retrieveCommand:
-U - DBMS user to enumerateCommand:
--alert - Run host OS command(s) when SQL injection is foundCommand:
--count - Retrieve number of entries for table(s)Command:
--crawl - Crawl the website starting from the target URLCommand:
--delay - Delay in seconds between each HTTP requestCommand:
--first - First query output word character to retrieveCommand:
--forms - Parse and test forms on target URLCommand:
--gpage - Use Google dork results from specified page numberCommand:
--level - Level of tests to perform (1-5, default 1)Command:
--proxy - Use a proxy to connect to the target URLCommand:
--purge - Safely remove all content from sqlmap data directoryCommand:
--roles - Enumerate DBMS users rolesCommand:
--scope - Regexp for filtering targetsCommand:
--smart - Perform thorough tests only if positive heuristic(s)Command:
--start - First dump table entry to retrieveCommand:
-T - DBMS database table(s) to enumerateCommand:
--users - Enumerate DBMS usersCommand:
--where - Use WHERE condition while table dumpingCommand:
--banner - Retrieve DBMS bannerCommand:
--base64 - Parameter(s) containing Base64 encoded dataCommand:
-C - DBMS database table column(s) to enumerateCommand:
--cookie - HTTP Cookie header value (e.g. PHPSESSID=a8d127e..)Command:
--header - Extra header (e.g. X-Forwarded-For: 127.0.0.1)Command:
--is-dba - Detect if the DBMS current user is DBACommand:
--method - Force usage of given HTTP method (e.g. PUT)Command:
--mobile - Imitate smartphone through HTTP User-Agent headerCommand:
--os-bof - Stored procedure buffer overflow exploitationCommand:
--os-cmd - Execute an operating system commandCommand:
--os-pwn - Prompt for an OOB shell, Meterpreter or VNCCommand:
--prefix - Injection payload prefix stringCommand:
--regexp - Regexp to match when query is evaluated to TrueCommand:
--repair - Redump entries having unknown character marker (?)Command:
--schema - Enumerate DBMS schemaCommand:
--search - Search column(s), table(s) and/or database name(s)Command:
--string - String to match when query is evaluated to TrueCommand:
--suffix - Injection payload suffix stringCommand:
--tables - Enumerate DBMS database tablesCommand:
--tamper - Use given script(s) for tampering injection dataCommand:
--titles - Compare pages based only on their titlesCommand:
--answers - Set predefined answers (e.g. quit=N,follow=N)Command:
--charset - Blind SQL injection charset (e.g. 0123456789abcdef)Command:
--chunked - Use HTTP chunked transfer encoded (POST) requestsCommand:
--cleanup - Clean up the DBMS from sqlmap specific UDF and tablesCommand:
--columns - Enumerate DBMS database table columnsCommand:
--csv-del - Delimiting character used in CSV output (default ,)Command:
--headers - Extra headers (e.g. Accept-Language: fr
ETag: 123)Command:
--no-cast - Turn off payload casting mechanismCommand:
--offline - Work in offline mode (only use session data)Command:
--referer - HTTP Referer header valueCommand:
--reg-add - Write a Windows registry key value dataCommand:
--reg-del - Delete a Windows registry key valueCommand:
--reg-key - Windows registry keyCommand:
--retries - Retries when the connection timeouts (default 3)Command:
--threads - Max number of concurrent HTTP(s) requests (default 1)Command:
--timeout - Seconds to wait before timeout connection (default 30)Command:
--comments - Check for DBMS comments during enumerationCommand:
--csrf-url - URL address to visit for extraction of anti-CSRF tokenCommand:
-D - DBMS database to enumerateCommand:
--dump-all - Dump all DBMS databases tables entriesCommand:
--encoding - Character encoding used for data retrieval (e.g. GBK)Command:
--hostname - Retrieve DBMS server hostnameCommand:
-l - Parse target(s) from Burp or WebScarab proxy log fileCommand:
--os-shell - Prompt for an interactive operating system shellCommand:
--priv-esc - Database process user privilege escalationCommand:
--reg-data - Windows registry key value dataCommand:
--reg-read - Read a Windows registry key valueCommand:
--reg-type - Windows registry key value typeCommand:
--retry-on - Retry request on regexp matching content (e.g. drop)Command:
--safe-req - Load safe HTTP request from a fileCommand:
--safe-url - URL address to visit frequently during testingCommand:
--skip-waf - Skip heuristic detection of WAF/IPS protectionCommand:
--sql-file - Execute SQL statements from given file(s)Command:
--time-sec - Seconds to delay the DBMS response (default 5)Command:
--tmp-path - Remote absolute path of temporary files directoryCommand:
--tor-port - Set Tor proxy port other than defaultCommand:
--tor-type - Set Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))Command:
--unstable - Adjust options for unstable connectionsCommand:
--web-root - Web server document root directory (e.g. /var/www)Command:
--auth-cred - HTTP authentication credentials (name:password)Command:
--auth-file - HTTP authentication PEM cert/private key fileCommand:
--auth-type - HTTP authentication type (Basic, Digest, Bearer, ...)Command:
-m - Scan multiple targets given in a textual fileCommand:
--check-tor - Check to see if Tor is used properlyCommand:
--csrf-data - POST data to send during anti-CSRF token page visitCommand:
--dbms-cred - DBMS authentication credentials (user:password)Command:
--file-dest - Back-end DBMS absolute filepath to write toCommand:
--file-read - Read a file from the back-end DBMS file systemCommand:
--force-ssl - Force usage of SSL/HTTPSCommand:
-z - Use short mnemonics (e.g. flu,bat,ban,tec=EU)Command:
--no-escape - Turn off string escaping mechanismCommand:
--param-del - Character used for splitting parameter values (e.g. &)Command:
--passwords - Enumerate DBMS users password hashesCommand:
--randomize - Randomly change value for given parameter(s)Command:
--reg-value - Windows registry key valueCommand:
--safe-freq - Regular requests between visits to a safe URLCommand:
--safe-post - POST data to send to a safe URLCommand:
--sql-query - SQL statement to be executedCommand:
--sql-shell - Prompt for an interactive SQL shellCommand:
--technique - SQL injection techniques to use (default BEUSTQ)Command:
--test-skip - Skip tests by payloads and/or titles (e.g. BENCHMARK)Command:
--text-only - Compare pages based only on the textual contentCommand:
-v - Verbosity level: 0-6 (default 1)Command:
--abort-code - Abort on (problematic) HTTP error code(s) (e.g. 401)Command:
--cookie-del - Character used for splitting cookie values (e.g. ;)Command:
--csrf-token - Parameter used to hold anti-CSRF tokenCommand:
--current-db - Retrieve DBMS current databaseCommand:
--dns-domain - Domain name used for DNS exfiltration attackCommand:
--file-write - Write a local file on the back-end DBMS file systemCommand:
--keep-alive - Use persistent HTTP(s) connectionsCommand:
--not-string - String to match when query is evaluated to FalseCommand:
--preprocess - Use given script(s) for preprocessing (request)Command:
--privileges - Enumerate DBMS users privilegesCommand:
--proxy-cred - Proxy authentication credentials (name:password)Command:
--proxy-file - Load proxy list from a fileCommand:
--proxy-freq - Requests between change of proxy from a given listCommand:
--second-req - Load second-order HTTP request from fileCommand:
--second-url - Resulting page URL searched for second-order responseCommand:
--shared-lib - Local path of the shared libraryCommand:
--statements - Retrieve SQL statements being run on DBMSCommand:
--time-limit - Run with a time limit in seconds (e.g. 3600)Command:
--udf-inject - Inject custom user-defined functionsCommand:
--union-char - Character to use for bruteforcing number of columnsCommand:
--union-cols - Range of columns to test for UNION query SQL injectionCommand:
--union-from - Table to use in FROM part of UNION query SQL injectionCommand:
--user-agent - HTTP User-Agent header valueCommand:
--base64-safe - Use URL and filename safe Base64 alphabet (RFC 4648)Command:
-c - Load options from a configuration INI fileCommand:
--csrf-method - HTTP method to use during anti-CSRF token page visitCommand:
--dump-format - Format of dumped data (CSV (default), HTML or SQLITE)Command:
--fingerprint - Perform an extensive DBMS version fingerprintCommand:
-g - Process Google dork results as target URLsCommand:
--ignore-code - Ignore (problematic) HTTP error code(s) (e.g. 401)Command:
--os-smbrelay - One click prompt for an OOB shell, Meterpreter or VNCCommand:
--postprocess - Use given script(s) for postprocessing (response)Command:
--skip-static - Skip testing parameters that not appear to be dynamicCommand:
--test-filter - Select tests by payloads and/or titles (e.g. ROW)Command:
--common-files - Check existence of common filesCommand:
--csrf-retries - Retries for anti-CSRF token retrieval (default 0)Command:
--current-user - Retrieve DBMS current userCommand:
--ignore-proxy - Ignore system default proxy settingsCommand:
--live-cookies - Live cookies file used for loading up-to-date valuesCommand:
--load-cookies - File containing cookies in Netscape/wget formatCommand:
-o - Turn on all optimization switchesCommand:
--param-filter - Select testable parameter(s) by place (e.g. POST)Command:
--parse-errors - Parse and display DBMS error messages from responsesCommand:
--pivot-column - Pivot column nameCommand:
--random-agent - Use randomly selected HTTP User-Agent header valueCommand:
-r - Load HTTP request from a fileCommand:
-s - Load session from a stored (.sqlite) fileCommand:
--table-prefix - Prefix used for temporary tables (default: sqlmap)Command:
--union-values - Column values to use for UNION query SQL injectionCommand:
--binary-fields - Result fields having binary values (e.g. digest)Command:
--common-tables - Check existence of common tablesCommand:
--crawl-exclude - Regexp to exclude pages from crawling (e.g. logout)Command:
--flush-session - Flush session files for current targetCommand:
--fresh-queries - Ignore query results stored in session fileCommand:
--param-exclude - Regexp to exclude parameters from testing (e.g. ses)Command:
--abort-on-empty - Abort data retrieval on empty resultsCommand:
--check-internet - Check Internet connection before assessing the targetCommand:
--common-columns - Check existence of common columnsCommand:
--exclude-sysdbs - Exclude DBMS system databases when enumerating tablesCommand:
--invalid-bignum - Use big numbers for invalidating valuesCommand:
--invalid-string - Use random strings for invalidating valuesCommand:
--predict-output - Predict common queries outputCommand:
--skip-urlencode - Skip URL encoding of payload dataCommand:
--drop-set-cookie - Ignore Set-Cookie header from responseCommand:
--ignore-timeouts - Ignore connection timeoutsCommand:
--invalid-logical - Use logical operations for invalidating valuesCommand:
--null-connection - Retrieve page length without actual HTTP response bodyCommand:
--skip-heuristics - Skip heuristic detection of vulnerabilitiesCommand:
-p - Testable parameter(s)Command:
--disable-coloring - Disable console output coloringCommand:
--ignore-redirects - Ignore redirection attemptsCommand:
-d - Connection string for direct database connectionCommand:
-X - DBMS database identifier(s) to not enumerate