Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Vulnerabilities

Confirm and exploit SQL injection on authorized targets

Detect and exploit SQL injection on authorized web targets.

Agent
Confirm injection on a suspect parameterEnumerate and dump a back-end databaseTest a crawl of parameterized URLs

overview

What sqlmap does

sqlmap probes parameters for SQL injection (boolean-blind, time-blind, error-based, UNION, stacked, out-of-band) from a --url, -r request file, or target list.

After a hit, the same session can enumerate with --dbs, dump with --dump, fingerprint the DBMS, or escalate when the injection allows it. Raise --level and --risk only as needed; use --tamper behind WAFs.

Wire it after a crawler that surfaces parameterized URLs. The managed node writes a folder of session data and dumps for triage. Only test systems you are authorized to assess.

source github.com/sqlmapproject/sqlmap

use cases

Where sqlmap fits

Confirm injection on a suspect parameter

Give sqlmap a URL or saved request with a candidate parameter and let it prove injectability before you spend time on manual payloads.

Enumerate and dump a back-end database

After detection, use --dbs, --tables, and --dump to map schema and extract rows for authorized data-exposure testing.

Test a crawl of parameterized URLs

Pipe a list of candidate URLs from a crawler into bulk mode so every query string and form field gets a consistent injection pass.

Bypass filters with tamper scripts

Load --tamper scripts and raise --level/--risk when a WAF or input filter blocks the default payload set.

reference

sqlmap inputs and flags

193 inputs
NameTypeFlagDescription
urlSTRING--urlTarget URL (e.g. "http://www.site.com/vuln.php?id=1").
dataSTRING--dataData string to be sent through POST.
request-fileFILE-rLoad HTTP request from a file.
dbsBOOLEAN--dbsEnumerate DBMS databases.
dumpBOOLEAN--dumpDump DBMS database table entries.
levelSTRING--levelLevel of tests to perform (1-5, default 1).
riskSTRING--riskRisk of tests to perform (1-3, default 1).
tamperSTRING--tamperUse given script(s) for tampering injection data.

Showing key inputs. sqlmap exposes 193 inputs in total.

Full flag reference (193 inputs)
NameTypeFlagDescription
osSTRING--osForce back-end DBMS operating system to provided value
allBOOLEAN--allRetrieve everything
dbsBOOLEAN--dbsEnumerate DBMS databases
etaBOOLEAN--etaDisplay for each output the estimated time of arrival
hexBOOLEAN--hexUse hex conversion during data retrieval
hppBOOLEAN--hppUse HTTP parameter pollution method
torBOOLEAN--torUse Tor anonymity network
urlSTRING--urlTarget URL (e.g. "http://www.site.com/vuln.php?id=1")
codeSTRING--codeHTTP code to match when query is evaluated to True
dataSTRING--dataData string to be sent through POST (e.g. "id=1")
dbmsSTRING--dbmsForce back-end DBMS to provided value
dumpBOOLEAN--dumpDump DBMS database table entries
evalSTRING--evalEvaluate provided Python code before the request (e.g. "import hashlib;id2=hashlib.md5(id).hexdigest()")
hostSTRING--hostHTTP Host header value
lastSTRING--lastLast query output word character to retrieve
riskSTRING--riskRisk of tests to perform (1-3, default 1)
skipSTRING--skipSkip testing for given parameter(s)
stopSTRING--stopLast dump table entry to retrieve
userSTRING-UDBMS user to enumerate
alertSTRING--alertRun host OS command(s) when SQL injection is found
countBOOLEAN--countRetrieve number of entries for table(s)
crawlSTRING--crawlCrawl the website starting from the target URL
delaySTRING--delayDelay in seconds between each HTTP request
firstSTRING--firstFirst query output word character to retrieve
formsBOOLEAN--formsParse and test forms on target URL
gpageSTRING--gpageUse Google dork results from specified page number
levelSTRING--levelLevel of tests to perform (1-5, default 1)
proxySTRING--proxyUse a proxy to connect to the target URL
purgeBOOLEAN--purgeSafely remove all content from sqlmap data directory
rolesBOOLEAN--rolesEnumerate DBMS users roles
scopeSTRING--scopeRegexp for filtering targets
smartBOOLEAN--smartPerform thorough tests only if positive heuristic(s)
startSTRING--startFirst dump table entry to retrieve
tableSTRING-TDBMS database table(s) to enumerate
usersBOOLEAN--usersEnumerate DBMS users
whereSTRING--whereUse WHERE condition while table dumping
bannerBOOLEAN--bannerRetrieve DBMS banner
base64STRING--base64Parameter(s) containing Base64 encoded data
columnSTRING-CDBMS database table column(s) to enumerate
cookieSTRING--cookieHTTP Cookie header value (e.g. "PHPSESSID=a8d127e..")
headerSTRING--headerExtra header (e.g. "X-Forwarded-For: 127.0.0.1")
is-dbaBOOLEAN--is-dbaDetect if the DBMS current user is DBA
methodSTRING--methodForce usage of given HTTP method (e.g. PUT)
mobileBOOLEAN--mobileImitate smartphone through HTTP User-Agent header
os-bofBOOLEAN--os-bofStored procedure buffer overflow exploitation
os-cmdBOOLEAN--os-cmdExecute an operating system command
os-pwnBOOLEAN--os-pwnPrompt for an OOB shell, Meterpreter or VNC
prefixSTRING--prefixInjection payload prefix string
regexpSTRING--regexpRegexp to match when query is evaluated to True
repairBOOLEAN--repairRedump entries having unknown character marker (?)
schemaBOOLEAN--schemaEnumerate DBMS schema
searchBOOLEAN--searchSearch column(s), table(s) and/or database name(s)
stringSTRING--stringString to match when query is evaluated to True
suffixSTRING--suffixInjection payload suffix string
tablesBOOLEAN--tablesEnumerate DBMS database tables
tamperSTRING--tamperUse given script(s) for tampering injection data
titlesBOOLEAN--titlesCompare pages based only on their titles
answersSTRING--answersSet predefined answers (e.g. "quit=N,follow=N")
charsetSTRING--charsetBlind SQL injection charset (e.g. "0123456789abcdef")
chunkedBOOLEAN--chunkedUse HTTP chunked transfer encoded (POST) requests
cleanupBOOLEAN--cleanupClean up the DBMS from sqlmap specific UDF and tables
columnsBOOLEAN--columnsEnumerate DBMS database table columns
csv-delSTRING--csv-delDelimiting character used in CSV output (default ",")
headersSTRING--headersExtra headers (e.g. "Accept-Language: fr\nETag: 123")
no-castBOOLEAN--no-castTurn off payload casting mechanism
offlineBOOLEAN--offlineWork in offline mode (only use session data)
refererSTRING--refererHTTP Referer header value
reg-addBOOLEAN--reg-addWrite a Windows registry key value data
reg-delBOOLEAN--reg-delDelete a Windows registry key value
reg-keySTRING--reg-keyWindows registry key
retriesSTRING--retriesRetries when the connection timeouts (default 3)
threadsSTRING--threadsMax number of concurrent HTTP(s) requests (default 1)
timeoutSTRING--timeoutSeconds to wait before timeout connection (default 30)
commentsBOOLEAN--commentsCheck for DBMS comments during enumeration
csrf-urlSTRING--csrf-urlURL address to visit for extraction of anti-CSRF token
databaseSTRING-DDBMS database to enumerate
dump-allBOOLEAN--dump-allDump all DBMS databases tables entries
encodingSTRING--encodingCharacter encoding used for data retrieval (e.g. GBK)
hostnameBOOLEAN--hostnameRetrieve DBMS server hostname
log-fileFILE-lParse target(s) from Burp or WebScarab proxy log file
os-shellBOOLEAN--os-shellPrompt for an interactive operating system shell
priv-escBOOLEAN--priv-escDatabase process user privilege escalation
reg-dataSTRING--reg-dataWindows registry key value data
reg-readBOOLEAN--reg-readRead a Windows registry key value
reg-typeSTRING--reg-typeWindows registry key value type
retry-onSTRING--retry-onRetry request on regexp matching content (e.g. "drop")
safe-reqFILE--safe-reqLoad safe HTTP request from a file
safe-urlSTRING--safe-urlURL address to visit frequently during testing
skip-wafBOOLEAN--skip-wafSkip heuristic detection of WAF/IPS protection
sql-fileFILE--sql-fileExecute SQL statements from given file(s)
time-secSTRING--time-secSeconds to delay the DBMS response (default 5)
tmp-pathSTRING--tmp-pathRemote absolute path of temporary files directory
tor-portSTRING--tor-portSet Tor proxy port other than default
tor-typeSTRING--tor-typeSet Tor proxy type (HTTP, SOCKS4 or SOCKS5 (default))
unstableBOOLEAN--unstableAdjust options for unstable connections
web-rootSTRING--web-rootWeb server document root directory (e.g. "/var/www")
auth-credSTRING--auth-credHTTP authentication credentials (name:password)
auth-fileFILE--auth-fileHTTP authentication PEM cert/private key file
auth-typeSTRING--auth-typeHTTP authentication type (Basic, Digest, Bearer, ...)
bulk-fileFILE-mScan multiple targets given in a textual file
check-torBOOLEAN--check-torCheck to see if Tor is used properly
csrf-dataSTRING--csrf-dataPOST data to send during anti-CSRF token page visit
dbms-credSTRING--dbms-credDBMS authentication credentials (user:password)
file-destSTRING--file-destBack-end DBMS absolute filepath to write to
file-readSTRING--file-readRead a file from the back-end DBMS file system
force-sslBOOLEAN--force-sslForce usage of SSL/HTTPS
mnemonicsSTRING-zUse short mnemonics (e.g. "flu,bat,ban,tec=EU")
no-escapeBOOLEAN--no-escapeTurn off string escaping mechanism
param-delSTRING--param-delCharacter used for splitting parameter values (e.g. &)
passwordsBOOLEAN--passwordsEnumerate DBMS users password hashes
randomizeSTRING--randomizeRandomly change value for given parameter(s)
reg-valueSTRING--reg-valueWindows registry key value
safe-freqSTRING--safe-freqRegular requests between visits to a safe URL
safe-postSTRING--safe-postPOST data to send to a safe URL
sql-querySTRING--sql-querySQL statement to be executed
sql-shellBOOLEAN--sql-shellPrompt for an interactive SQL shell
techniqueSTRING--techniqueSQL injection techniques to use (default "BEUSTQ")
test-skipSTRING--test-skipSkip tests by payloads and/or titles (e.g. BENCHMARK)
text-onlyBOOLEAN--text-onlyCompare pages based only on the textual content
verbositySTRING-vVerbosity level: 0-6 (default 1)
abort-codeSTRING--abort-codeAbort on (problematic) HTTP error code(s) (e.g. 401)
cookie-delSTRING--cookie-delCharacter used for splitting cookie values (e.g. ;)
csrf-tokenSTRING--csrf-tokenParameter used to hold anti-CSRF token
current-dbBOOLEAN--current-dbRetrieve DBMS current database
dns-domainSTRING--dns-domainDomain name used for DNS exfiltration attack
file-writeFILE--file-writeWrite a local file on the back-end DBMS file system
keep-aliveBOOLEAN--keep-aliveUse persistent HTTP(s) connections
not-stringSTRING--not-stringString to match when query is evaluated to False
preprocessSTRING--preprocessUse given script(s) for preprocessing (request)
privilegesBOOLEAN--privilegesEnumerate DBMS users privileges
proxy-credSTRING--proxy-credProxy authentication credentials (name:password)
proxy-fileFILE--proxy-fileLoad proxy list from a file
proxy-freqSTRING--proxy-freqRequests between change of proxy from a given list
second-reqFILE--second-reqLoad second-order HTTP request from file
second-urlSTRING--second-urlResulting page URL searched for second-order response
shared-libFILE--shared-libLocal path of the shared library
statementsBOOLEAN--statementsRetrieve SQL statements being run on DBMS
time-limitSTRING--time-limitRun with a time limit in seconds (e.g. 3600)
udf-injectBOOLEAN--udf-injectInject custom user-defined functions
union-charSTRING--union-charCharacter to use for bruteforcing number of columns
union-colsSTRING--union-colsRange of columns to test for UNION query SQL injection
union-fromSTRING--union-fromTable to use in FROM part of UNION query SQL injection
user-agentSTRING--user-agentHTTP User-Agent header value
base64-safeBOOLEAN--base64-safeUse URL and filename safe Base64 alphabet (RFC 4648)
config-fileFILE-cLoad options from a configuration INI file
csrf-methodSTRING--csrf-methodHTTP method to use during anti-CSRF token page visit
dump-formatSTRING--dump-formatFormat of dumped data (CSV (default), HTML or SQLITE)
fingerprintBOOLEAN--fingerprintPerform an extensive DBMS version fingerprint
google-dorkSTRING-gProcess Google dork results as target URLs
ignore-codeSTRING--ignore-codeIgnore (problematic) HTTP error code(s) (e.g. 401)
os-smbrelayBOOLEAN--os-smbrelayOne click prompt for an OOB shell, Meterpreter or VNC
postprocessSTRING--postprocessUse given script(s) for postprocessing (response)
skip-staticBOOLEAN--skip-staticSkip testing parameters that not appear to be dynamic
test-filterSTRING--test-filterSelect tests by payloads and/or titles (e.g. ROW)
common-filesBOOLEAN--common-filesCheck existence of common files
csrf-retriesSTRING--csrf-retriesRetries for anti-CSRF token retrieval (default 0)
current-userBOOLEAN--current-userRetrieve DBMS current user
ignore-proxyBOOLEAN--ignore-proxyIgnore system default proxy settings
live-cookiesSTRING--live-cookiesLive cookies file used for loading up-to-date values
load-cookiesSTRING--load-cookiesFile containing cookies in Netscape/wget format
optimizationBOOLEAN-oTurn on all optimization switches
param-filterSTRING--param-filterSelect testable parameter(s) by place (e.g. "POST")
parse-errorsBOOLEAN--parse-errorsParse and display DBMS error messages from responses
pivot-columnSTRING--pivot-columnPivot column name
random-agentBOOLEAN--random-agentUse randomly selected HTTP User-Agent header value
request-fileFILE-rLoad HTTP request from a file
session-fileFILE-sLoad session from a stored (.sqlite) file
table-prefixSTRING--table-prefixPrefix used for temporary tables (default: "sqlmap")
union-valuesSTRING--union-valuesColumn values to use for UNION query SQL injection
binary-fieldsSTRING--binary-fieldsResult fields having binary values (e.g. "digest")
common-tablesBOOLEAN--common-tablesCheck existence of common tables
crawl-excludeSTRING--crawl-excludeRegexp to exclude pages from crawling (e.g. "logout")
flush-sessionBOOLEAN--flush-sessionFlush session files for current target
fresh-queriesBOOLEAN--fresh-queriesIgnore query results stored in session file
param-excludeSTRING--param-excludeRegexp to exclude parameters from testing (e.g. "ses")
abort-on-emptyBOOLEAN--abort-on-emptyAbort data retrieval on empty results
check-internetBOOLEAN--check-internetCheck Internet connection before assessing the target
common-columnsBOOLEAN--common-columnsCheck existence of common columns
exclude-sysdbsBOOLEAN--exclude-sysdbsExclude DBMS system databases when enumerating tables
invalid-bignumBOOLEAN--invalid-bignumUse big numbers for invalidating values
invalid-stringBOOLEAN--invalid-stringUse random strings for invalidating values
predict-outputBOOLEAN--predict-outputPredict common queries output
skip-urlencodeBOOLEAN--skip-urlencodeSkip URL encoding of payload data
drop-set-cookieBOOLEAN--drop-set-cookieIgnore Set-Cookie header from response
ignore-timeoutsBOOLEAN--ignore-timeoutsIgnore connection timeouts
invalid-logicalBOOLEAN--invalid-logicalUse logical operations for invalidating values
null-connectionBOOLEAN--null-connectionRetrieve page length without actual HTTP response body
skip-heuristicsBOOLEAN--skip-heuristicsSkip heuristic detection of vulnerabilities
test-parametersSTRING-pTestable parameter(s)
disable-coloringBOOLEAN--disable-coloringDisable console output coloring
ignore-redirectsBOOLEAN--ignore-redirectsIgnore redirection attempts
connection-stringSTRING-dConnection string for direct database connection
exclude-idnetifiersSTRING-XDBMS database identifier(s) to not enumerate

example

Run sqlmap

sqlmap · command
# detect injection on a parameter, then list databases (authorized lab target)sqlmap --url="http://example.com/page?id=1" --answers="quit=N,follow=N" --level=2 --risk=1 --dbs
sample output
[*] starting @ 12:04:17[12:04:18] [INFO] testing connection to the target URL[12:04:19] [INFO] checking if the target is protected by some kind of WAF/IPS[12:04:21] [INFO] testing if the target URL content is stable[12:04:22] [INFO] GET parameter 'id' appears to be injectable[12:04:28] [INFO] the back-end DBMS is PostgreSQLavailable databases [2]:[*] example[*] information_schema

guidance

Choosing sqlmap

Use sqlmap when you already have a URL or request with a suspect parameter, or a crawl of candidates to test. It does not discover URLs. Crawl first, then confirm and exploit. Authorized targets only.

ghauri

Injection tool with strong WAF evasion. sqlmap keeps broader DBMS coverage and feature depth.

nuclei

Template scanner that flags likely injection points. Use it to triage, then sqlmap to confirm and exploit.

faq

sqlmap questions

Pass the target with --url, for example sqlmap --url="http://example.com/page?id=1" --answers="quit=N,follow=N". Add --dbs to enumerate databases once injection is confirmed.

related

More Vulnerabilities tools

  1. agentsleak

    Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.

  2. commix

    Automates OS command injection detection and exploitation.

  3. dalfox

    Parameter mining and XSS testing with headless verification.

  4. dnsreaper

    Subdomain takeover scanner with cloud-zone intake.

  5. find-gh-poc

    Locate public CVE proof-of-concept repositories on GitHub.

  6. golemhalt

    Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.

Run sqlmap yourself

A target is crawled by katana for parameterized URLs, then sqlmap tests them for injection and writes the confirmed findings as output.

Open sqlmap in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.