forked from vizzdoom/sqlmap-command-builder
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathsql-command-builder.html
More file actions
1663 lines (1470 loc) · 129 KB
/
Copy pathsql-command-builder.html
File metadata and controls
1663 lines (1470 loc) · 129 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SQLMap Command Generator</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<div class="container">
<header class="header">
<h1><a href="?">SQLMap Command Builder</a></h1>
<p>
<em>Interactive command line generator for conducting advanced SQLMap pentests.<br />
This builder works locally with pure HTML/JS/CSS (no data exchanged to any server).</em>
</p>
<p>
<strong><a href="https://github.com/vizzdoom/sqlmap-command-builder" target="_blank">SQLMap Command Builder <span id="tool-version"></span></a></strong> | Compatible with <strong><a target="_blank" href="https://github.com/sqlmapproject/sqlmap/releases">SQLMap 1.9.4</a></strong> | vizzdoom/at/gmail/dot/com
</p>
</header>
<!-- Command Output Area -->
<div class="command-header">
<button id="copyBtn" class="btn btn--primary">
<svg clip-rule="evenodd" fill-rule="evenodd" stroke-linejoin="round" stroke-miterlimit="2" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="m6 19v2c0 .621.52 1 1 1h2v-1.5h-1.5v-1.5zm7.5 3h-3.5v-1.5h3.5zm4.5 0h-3.5v-1.5h3.5zm4-3h-1.5v1.5h-1.5v1.5h2c.478 0 1-.379 1-1zm-1.5-1v-3.363h1.5v3.363zm0-4.363v-3.637h1.5v3.637zm-13-3.637v3.637h-1.5v-3.637zm11.5-4v1.5h1.5v1.5h1.5v-2c0-.478-.379-1-1-1zm-10 0h-2c-.62 0-1 .519-1 1v2h1.5v-1.5h1.5zm4.5 1.5h-3.5v-1.5h3.5zm3-1.5v-2.5h-13v13h2.5v-1.863h1.5v3.363h-4.5c-.48 0-1-.379-1-1v-14c0-.481.38-1 1-1h14c.621 0 1 .522 1 1v4.5h-3.5v-1.5z" fill-rule="nonzero"/></svg>
COPY TO A CLIPBOARD
</button>
<button id="copyUrlBtn" class="btn btn--primary">
<svg viewBox="0 0 24 24" id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg"><defs><style>.cls-1{fill:none;stroke:#020202;stroke-miterlimit:10;stroke-width:1.92px;}</style></defs><path class="cls-1" d="M10.56,5.77l2.72-2.72a5.43,5.43,0,0,1,3.84-1.59,5.43,5.43,0,0,1,5.42,5.42A5.43,5.43,0,0,1,21,10.72l-2.72,2.72"/><path class="cls-1" d="M5.77,10.56,3.05,13.28A5.42,5.42,0,1,0,10.72,21l2.72-2.72"/><line class="cls-1" x1="16.79" y1="7.21" x2="7.21" y2="16.79"/><line class="cls-1" x1="20.63" y1="15.83" x2="23.5" y2="15.83"/><line class="cls-1" x1="15.83" y1="20.63" x2="15.83" y2="23.5"/><line class="cls-1" x1="19.19" y1="19.19" x2="21.1" y2="21.1"/><line class="cls-1" x1="3.38" y1="8.17" x2="0.5" y2="8.17"/><line class="cls-1" x1="8.17" y1="3.38" x2="8.17" y2="0.5"/><line class="cls-1" x1="4.81" y1="4.81" x2="2.9" y2="2.9"/></svg>
COPY CONFIG URL
</button>
</div>
<section class="command-section">
<div class="command-output">
<pre id="commandOutput" spellcheck="false" contenteditable="true">sqlmap</pre>
</div>
</section>
<!-- Options Tabs -->
<section class="options-section">
<div class="tabs">
<button class="tab-btn active" data-tab="target">TARGET</button>
<button class="tab-btn" data-tab="connection">CONNECTION</button>
<button class="tab-btn" data-tab="request">REQUEST</button>
<button class="tab-btn" data-tab="injection">INJECTION</button>
<button class="tab-btn" data-tab="exploitation">EXPLOITATION</button>
<button class="tab-btn" data-tab="tampering">TAMPERING</button>
<button class="tab-btn" data-tab="sqlmap">SQLMAP</button>
<button class="tab-btn" data-tab="config">CONFIG</button>
</div>
<!-- TARGET Tab -->
<div class="tab-content active" id="target">
<div class="card">
<div class="card__body">
<div class="form-grid">
<!-- -u -->
<div class="form-group">
<label class="form-label" for="url">TARGET URL<i tooltip="Target URL to scan.">ⁱ</i></label>
<label class="form-label" for="url"><u>-u</u></label>
<input type="url" id="url" class="form-control" placeholder="https://127.0.0.1/page?id=1">
</div>
<!-- -d -->
<div class="form-group">
<label class="form-label" for="directDb">DATABASE CONNECTION STRING<i tooltip="Connection string for direct database connection.">ⁱ</i></label>
<label class="form-label" for="directDb"><u>-d</u></label>
<input type="text" id="directDb" class="form-control" placeholder="mysql://user:pass@host/db">
</div>
<!-- -g -->
<div class="form-group">
<label class="form-label" for="googleDork">GOOGLE DORK FOR TARGETS<i tooltip="Process Google dork results as target URLs.">ⁱ</i></label>
<label class="form-label" for="googleDork"><u>-g</u></label>
<input type="text" id="googleDork" class="form-control" placeholder="inurl:php?id=">
</div>
<!-- -m -->
<div class="form-group">
<label class="form-label" for="targetsFile">FILE WITH TARGETS<i tooltip="Scan multiple targets given in a textual file.">ⁱ</i></label>
<label class="form-label" for="targetsFile"><u>-m</u></label>
<input type="text" id="targetsFile" class="form-control" placeholder="targets.txt">
</div>
<!-- -l -->
<div class="form-group">
<label class="form-label" for="burpFile">BURP FILE WITH HTTP REQUESTS<i tooltip="Rather than providing a single target URL, it is possible to test and inject against HTTP requests proxied through Burp proxy.">ⁱ</i></label>
<label class="form-label" for="burpFile"><u>-l</u></label>
<input type="text" id="burpFile" class="form-control" placeholder="burp.txt">
</div>
<!-- --scope -->
<div class="form-group" title="">
<label class="form-label" for="burpFileScope">SCOPE FOR BURP PROXY FILE<i tooltip="Rather than using all hosts parsed from provided logs with option -l, you can specify valid Python regular expression to be used for filtering desired ones.">ⁱ</i></label>
<label class="form-label" for="burpFileScope"><u>--scope</u></label>
<input type="text" id="burpFileScope" class="form-control" placeholder="(www)?\.target\.(com|net|org)">
</div>
</div>
</div>
</div>
</div>
<!-- CONNECTION Tab -->
<div class="tab-content" id="connection">
<div class="card">
<div class="card__body">
<div class="form-grid">
<h3>Connection Control</h3>
<!-- --timeout -->
<div class="form-group">
<label class="form-label" for="timeout">REQUEST TIMEOUT<i tooltip="Seconds to wait before timeout connection.
Default: 30 seconds">ⁱ</i></label>
<label class="form-label" for="timeout"><u>--timeout</u></label>
<input type="number" id="timeout" class="form-control" min="1" max="300" placeholder="10 (seconds)">
</div>
<!-- --delay -->
<div class="form-group">
<label class="form-label" for="delay">DELAY BETWEEN REQUEST<i tooltip="Delay (in seconds) between each HTTP request">ⁱ</i></label>
<label class="form-label" for="delay"><u>--delay</u></label>
<input type="number" id="delay" class="form-control" min="0.01" step="0.01" placeholder="2.25 (seconds)">
</div>
<!-- --threads -->
<div class="form-group">
<label class="form-label" for="threads">NUMBER OF CONCURRENT REQUESTS<i tooltip="Max number of concurrent HTTP(s) requests.
Default: 1 | Maximum: 10"> ⁱ </i></label>
<label class="form-label" for="threads"><u>--threads</u></label>
<input type="number" id="threads" class="form-control" min="1" max="10" placeholder="1">
</div>
<!-- SPACER -->
<div></div>
<!-- force-ssl -->
<div class="form-group">
<label class="checkbox-label" for="forceSsl">
<input type="checkbox" id="forceSsl">
<b>FORCE USAGE OF HTTPS REQUESTS</b>
<u>--force-ssl</u><i tooltip="In case that user wants to force usage of SSL/HTTPS requests toward the target, he can use this switch.
This can be alse useful in cases when urls are being collected by --crawl or when Burp log is being provided with option -l.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<!-- --keep-alive -->
<div class="form-group">
<label class="checkbox-label" for="keepAlive">
<input type="checkbox" id="keepAlive">
<b>PERSISTENT CONNECTIONS OPTIMIZATION</b>
<u>--keep-alive</u><i tooltip="Connection optimization - using persistent HTTP(s) connections">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<!-- --null-connection -->
<div class="form-group">
<label class="checkbox-label" for="nullConnection">
<input type="checkbox" id="nullConnection">
<b>HTTP NULL CONNECTIONS OPTIMIZATION</b>
<u>--null-connection</u><i tooltip="Connection optimization - Retrieve page length without actual HTTP response body.
There are special HTTP request types which can be used to retrieve HTTP response's size without getting the HTTP body.
This knowledge can be used in blind injection technique to distinguish True from False responses.
When this switch is provided, sqlmap will try to test and exploit two different NULL connection techniques: Range and HEAD.
If any of these is supported by the target web server, speed up will come from the obvious saving of used bandwidth.
Remark: incompatible with --text-only.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<!-- --http2 -->
<div class="form-group">
<label class="checkbox-label" for="http2">
<input type="checkbox" id="http2">
<b>USE HTTP2 CONNECTIONS</b>
<u>--http2</u><i tooltip="Connection optimization - Use HTTP version 2 (experimental).">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<h3>Proxy Options</h3>
<!-- --proxy -->
<div class="form-group">
<label class="form-label" for="proxy">HTTP(S) PROXY<i tooltip="Use a proxy to connect to the target URL.">ⁱ</i></label>
<label class="form-label" for="proxy"><u>--proxy</u></label>
<input type="text" id="proxy" class="form-control" placeholder="http://127.0.0.1:8080">
</div>
<!-- --proxy-cred -->
<div class="form-group">
<label class="form-label" for="proxyCred">HTTP(S) PROXY CREDENTIAL<i tooltip="If the HTTP(S) proxy requires authentication, you can provide the credentials in the format username:password to the option --proxy-cred.">ⁱ</i></label>
<label class="form-label" for="proxyCred"><u>--proxy-cred</u></label>
<input type="text" id="proxyCred" class="form-control" placeholder="username:password">
</div>
<!-- --proxy-file -->
<div class="form-group">
<label class="form-label" for="proxyFile">HTTP(S) PROXY FILE<i tooltip="Use a proxy to connect to the target URL.">ⁱ</i></label>
<label class="form-label" for="proxyFile"><u>--proxy-file</u></label>
<input type="text" id="proxyFile" class="form-control" placeholder="proxy-file.txt">
</div>
<!-- --proxy-freq -->
<div class="form-group">
<label class="form-label" for="proxyFreq">PROXY ROTATION NUMBER<i tooltip="Requests between change of proxy from a given --proxy-file list.">ⁱ</i></label>
<label class="form-label" for="proxyFreq"><u>--proxy-freq</u></label>
<input type="number" id="proxyFreq" class="form-control" min="1" step="1" placeholder="3">
</div>
<!-- --ignore-proxy -->
<div class="form-group">
<label class="checkbox-label" for="proxyIgnore">
<input type="checkbox" id="proxyIgnore">
<b>IGNORE SYSTEM PROXY SETTINGS</b>
<u>--ignore-proxy</u><i tooltip="Run sqlmap against a target part of a local area network by ignoring the system-wide set HTTP(S) proxy server setting.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<div class="form-group">
<span class="form-label checkbox-grid">TOR ANONYMITY NETWORK SETTINGS</span>
<div class="checkbox-grid">
<!-- --tor -->
<label class="checkbox-label" for="tor">
<input type="checkbox" id="tor">
<u>--tor</u><i tooltip="If, for any reason, you need to stay anonymous, instead of passing by a single predefined HTTP(S) proxy server, you can configure a Tor client together with Privoxy (or similar) on your machine as explained in Tor installation guides.
Then you can use a switch --tor and sqlmap will try to automatically set Tor proxy connection settings.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --check-tor -->
<label class="checkbox-label" for="checkTor">
<input type="checkbox" id="checkTor">
<b></b>
<u>--check-tor</u><i tooltip="You are strongly advised to use --check-tor occasionally to be sure that everything was set up properly.
With --check-tor sqlmap will check if everything works as expected by sending a single request to an official 'Are you using Tor?' page before any target requests.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
</div>
<!-- --tor-port -->
<div class="form-group">
<label class="form-label" for="torPort">TOR PROXY PORT<i tooltip="In case that you want to manually set the port of used Tor proxy.">ⁱ</i></label>
<label class="form-label" for="torPort"><u>--tor-port</u></label>
<input type="number" id="torPort" class="form-control" min="1" max="65535" placeholder="9050">
</div>
<!-- --tor-type -->
<div class="form-group">
<label class="form-label" for="torType">TOR PROXY TYPE<i tooltip="In case that you want to manually set the type of used Tor proxy.">ⁱ</i></label>
<label class="form-label" for="torType"><u>--tor-type</u></label>
<select id="torType" class="form-control">
<option value="">-- Choose Type --</option>
<option value="SOCKS5">SOCKS5 (default)</option>
<option value="SOCKS4">SOCKS4</option>
<option value="HTTP">HTTP</option>
</select>
</div>
</div>
</div>
</div>
</div>
<!-- REQUEST Tab -->
<div class="tab-content" id="request">
<div class="card">
<div class="card__body">
<div class="form-grid">
<h3>Request Data</h3>
<!-- --method -->
<div class="form-group">
<label class="form-label" for="method">HTTP REQUEST METHOD<i tooltip="Force usage of given HTTP method (e.g. PUT).">ⁱ</i></label>
<label class="form-label" for="method"><u>--method</u></label>
<select id="method" class="form-control">
<option value="">-- Choose HTTP Method --</option>
<option value="GET">GET</option>
<option value="POST">POST</option>
<option value="PUT">PUT</option>
<option value="DELETE">DELETE</option>
<option value="HEAD">HEAD</option>
<option value="OPTIONS">OPTIONS</option>
<option value="PATCH">PATCH</option>
<option value="custom">--Custom--</option>
</select>
<div class="form-group" id="customHttpMethodGroup" style="display: none">
<input type="text" id="customHttpMethod" class="form-control" placeholder="Custom HTTP method value">
</div>
</div>
<!-- --param-del -->
<div class="form-group">
<label class="form-label" for="paramDel">PARAMETER DELIMITER<i tooltip="There are cases when default parameter delimiter (&) needs to be overwritten for sqlmap to be able to properly split and process each parameter separately, e.g.:
query=foobar;id=1 instead query=foobar&id=1">ⁱ</i></label>
<label class="form-label" for="paramDel"><u>--param-del</u></label>
<input type="text" id="paramDel" class="form-control" placeholder="&">
</div>
<!-- -r -->
<div class="form-group">
<label class="form-label" for="requestFile">FILE WITH AN HTTP REQUEST<i tooltip="Load HTTP request from a file">ⁱ</i></label>
<label class="form-label" for="requestFile"><u>-r</u></label>
<input type="text" id="requestFile" class="form-control" placeholder="request.txt">
</div>
<!-- --data -->
<div class="form-group">
<label class="form-label" for="data">HTTP BODY DATA<i tooltip="By default the HTTP method used to perform HTTP requests is GET, but you can implicitly change it to POST by providing the data to be sent in the POST requests.
Such data, being those parameters, are tested for SQL injection as well as any provided GET parameters.">ⁱ</i></label>
<label class="form-label" for="data"><u>--data</u></label>
<textarea id="data" class="form-control" rows="4" placeholder="param1=value1¶m2=value2"></textarea>
</div>
<h3>Request Headers</h3>
<!-- --host -->
<div class="form-group">
<label class="form-label" for="host">CUSTOM HTTP HOST HEADER<i tooltip="You can manually set HTTP Host header value.
By default HTTP Host header is parsed from a provided target URL.
Note that also the HTTP Host header is tested against SQL injection if the --level is set to 5.">ⁱ</i></label>
<label class="form-label" for="host"><u>--host</u></label>
<input type="text" id="host" class="form-control" placeholder="example.com">
</div>
<!-- -A / --random-agent / --mobile -->
<div class="form-group">
<label class="form-label" for="userAgent">USER-AGENT HEADER VALUE<i tooltip="By default sqlmap performs HTTP requests with the "sqlmap/1.0-dev-x (http://sqlmap.org)" User-Agent header, but it can changed with the option -A.
Moreover, by providing the switch --random-agent, sqlmap will randomly select a User-Agent from the ./txt/user-agents.txt textual file and use it for all HTTP requests within the session.
Some sites perform a server-side check of HTTP User-Agent header value and fail the HTTP response if a valid User-Agent is not provided, its value is not expected or is blacklisted by a web application firewall or similar intrusion prevention system.
Sometimes web servers expose different interfaces toward mobile phones than to desktop computers.
In such cases you can enforce usage of one of predetermined smartphone HTTP User-Agent header values by using a --mobile switch (sqlmap will ask you to pick one of popular smartphones which it will imitate in current run).
Note that also the HTTP User-Agent header is tested against SQL injection if the --level is set to 3 or above.">ⁱ</i></label>
<label class="form-label" for="userAgent"><u>--mobile / --random-agent / -A</u></label>
<select id="userAgent" class="form-control">
<option value="">Default: sqlmap/1.0-dev-x (http://sqlmap.org)</option>
<option value="mobile">--mobile</option>
<option value="random">--random-agent</option>
<option value="custom">--Custom--</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for Windows</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for macOS</option>
<option value="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Google Chrome 137 for Linux</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1">Google Chrome 137 for iOS/iPhone</option>
<option value="Mozilla/5.0 (iPad; CPU OS 17_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/137.0.7151.79 Mobile/15E148 Safari/604.1">Google Chrome 137 for iOS/iPad</option>
<option value="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.73 Mobile Safari/537.36">Google Chrome 137 for Android</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36">Microsoft Edge 137 for Windows</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.3296.68">Microsoft Edge 137 macOS</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 EdgiOS/137.3296.65 Mobile/15E148 Safari/605.1.15">Microsoft Edge 137 for iOS</option>
<option value="Mozilla/5.0 (Linux; Android 10; HD1913) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.7151.73 Mobile Safari/537.36 EdgA/137.0.3296.53">Microsoft Edge 137 for Android</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15">Apple Safari 18.4 for macOS</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1">Apple Safari 18.4 for iOS/iPhone</option>
<option value="Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1">Apple Safari 18.4 for iOS/iPad</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for Windows</option>
<option value="Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for macOS</option>
<option value="Mozilla/5.0 (X11; Linux i686; rv:139.0) Gecko/20100101 Firefox/139.0">Firefox 139 for Linux</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/139.0 Mobile/15E148 Safari/605.1.15">Firefox 139 for iOS/iPhone</option>
<option value="Mozilla/5.0 (iPad; CPU OS 14_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/139.0 Mobile/15E148 Safari/605.1.15">Firefox 139 for iOS/iPad</option>
<option value="Mozilla/5.0 (Android 15; Mobile; rv:139.0) Gecko/139.0 Firefox/139.0">Firefox 139 for Android</option>
<option value="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OPR/119.0.0.0">Opera for Windows</option>
<option value="Mozilla/5.0 (Linux; Android 15; Pixel 8 Pro Build/AP4A.250205.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.39 Mobile Safari/537.36 THDConsumer/7.45 (Android 15; Pixel 8 Pro) DID:84d0d3e3907e6ea1">Android 15 WebView for Pixel 8 Pro</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 [FBAN/FBIOS;FBAV/507.0.0.58.94;FBBV/716584418;FBDV/iPhone17,4;FBMD/iPhone;FBSN/iOS;FBSV/18.3.2;FBSS/3;FBID/phone;FBLC/en_US;FBOP/5;FBRV/719878764;IABMV/1]">Facebook App for iOS 18.3.2</option>
<option value="Mozilla/5.0 (Linux; Android 14; SM-A137F Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/134.0.6998.135 Mobile Safari/537.36 [FBAN/EMA;FBLC/sk_SK;FBAV/451.0.0.9.108;FB_FW/1;FBDM/DisplayMetrics{density=2.8125, width=1080, height=2301,2.8125, xdpi=403.411, ydpi=399.759};]">Facebook App for Android 14</option>
<option value="Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/22D82 Instagram 344.0.9.27.90 (iPhone15,4; iOS 18_3_2; en_US; en; scale=3.00; 1179x2556; 631222391) NW/3">Instagram App for iOS 18.3.2</option>
<option value="Mozilla/5.0 (Linux; Android 14; SM-S906U Build/UP1A.231005.007; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/135.0.7049.38 Mobile Safari/537.36 Instagram 374.0.0.43.67 Android (34/14; 480dpi; 1080x2122; samsung; SM-S906U; g0q; qcom; en_US; 715888958; IABMV/1)">Instagram App for Android 14</option>
</select>
<div class="form-group" id="customUserAgentGroup" style="display: none;">
<input type="text" id="customUserAgent" class="form-control" placeholder="Custom User Agent value">
</div>
</div>
<!-- --referer -->
<div class="form-group">
<label class="form-label" for="referer">HTTP REFERER HEADER<i tooltip="By default no HTTP Referer header is sent in HTTP requests if not explicitly set by the --referer switch.
Note that also the HTTP Referer header is tested against SQL injection if the --level is set to 3 or above.">ⁱ</i></label>
<label class="form-label" for="referer"><u>--referer</u></label>
<input type="url" id="referer" class="form-control" placeholder="https://127.0.0.1/login">
</div>
<!-- -headers -->
<div class="form-group">
<label class="form-label" for="headers">EXTRA HTTP HEADERS<i tooltip="Extra HTTP headers separated by a newline.">ⁱ</i></label>
<label class="form-label" for="headers"><u>--headers</u></label>
<textarea id="headers" class="form-control" rows="4" placeholder="X-Forwarded-For: 127.0.0.1 Authorization: Bearer token"></textarea>
</div>
<h3>Authentication</h3>
<!-- --cookie -->
<div class="form-group">
<label class="form-label" for="cookie">COOKIE VALUE<i tooltip="HTTP Cookie header value for authentication (and for exploitation if the --level is set to 2 or above).
If you provide a HTTP Cookie header with option --cookie and the target URL sends an HTTP Set-Cookie header at any time, sqlmap will ask you which set of cookies to use for the following HTTP requests.
See also: --drop-set-cookie">ⁱ</i></label>
<label class="form-label" for="cookie"><u>--cookie</u></label>
<input id="cookie" class="form-control" placeholder="PHPSESSID=abc123; userid=1"></input>
</div>
<!-- --cookie-del -->
<div class="form-group">
<label class="form-label" for="cookieDel">COOKIE DELIMITER<i tooltip="The HTTP Cookie header values are usually separated by a ; character, not by an &.
Sqlmap can recognize these as separate sets of parameter=value too, as well as GET and POST parameters.
In case that the separation character is other than ; it can be specified by using option --cookie-del">ⁱ</i></label>
<label class="form-label" for="cookieDel"><u>--cookie-del</u></label>
<input type="text" id="cookieDel" class="form-control" placeholder=";">
</div>
<!-- --live-cookies -->
<div class="form-group">
<label class="form-label" for="cookieLive">LIVE COOKIES FILE<i tooltip="Option --live-cookies can be used to provide a cookies file which will be used for loading of up-to-date values.
This means that that same file will be read prior to each request to get the latest value for HTTP Cookie header. It should point to a file with fresh/up-to-date cookie values.
Trick is that once you delete its content, sqlmap immediately will stop and wait for the update of its content. Same applies if you just modify its content in-place.You can do this indefinitely number of times during a run.
In your case, you can just run sqlmap in one terminal with --live-cookies pointing to a file containing starting cookie value, while in another terminal you can do a periodic deletion and filling of that same file.">ⁱ</i></label>
<label class="form-label" for="cookieLive"><u>--live-cookies</u></label>
<input type="text" id="cookieLive" class="form-control" placeholder="live-cookies.txt">
</div>
<!-- --load-cookies -->
<div class="form-group">
<label class="form-label" for="cookieLoad">RAW COOKIE FILE<i tooltip="An option --load-cookies can be used to provide a special file containing Netscape/wget formatted cookies.
This format includes not only cookie names and values but also their domains, paths, expiry, and security attributes.
Unlike the --cookie or -H options which requires to manually enter raw cookie strings, the --load-cookies reads structures cookie data, which can help fully replicate a browser session.">ⁱ</i></label>
<label class="form-label" for="cookieLoad"><u>--load-cookies</u></label>
<input type="text" id="cookieLoad" class="form-control" placeholder="load-cookies.txt">
</div>
<!-- --drop-set-cookie -->
<div class="form-group">
<label class="checkbox-label" for="cookieDrop">
<input type="checkbox" id="cookieDrop">
<b>IGNORE Set-Cookie HEADER</b>
<u>--drop-set-cookie</u><i tooltip="If the web application responds with Set-Cookie headers, sqlmap will automatically use its value in all further HTTP requests as the Cookie header. Sqlmap will also automatically test those values for SQL injection.
This can be avoided by providing the switch --drop-set-cookie.
Therefore, an sqlmap will ignore any coming Set-Cookie header.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<div></div>
<!-- --auth-type/--auth-cred -->
<div class="form-group">
<label class="form-label" for="authCred">HTTP PROTOCOL AUTHENTICATION<i tooltip="These options can be used to specify which HTTP protocol authentication back-end web server implements and the valid credentials to be used to perform all HTTP requests to the target application.">ⁱ</i></label>
<label class="form-label" for="authCred"><u>--auth-type / --auth-cred</u></label>
<select id="authType" class="form-control">
<option value="">-- Choose auth method --</option>
<option value="Basic">Basic</option>
<option value="Digest">Digest</option>
<option value="NTLM">NTLM</option>
</select>
<div class="form-group">
<input type="text" id="authCred" class="form-control" placeholder="username:password">
</div>
</div>
<!-- --auth-file -->
<div class="form-group">
<label class="form-label" for="authFile">PRIVATE KEY AUTHENTICATION<i tooltip="This option should be used in cases when the web server requires proper client-side certificate and a private key for authentication.
Supplied value should be a PEM formatted key_file that contains your certificate and a private key.">ⁱ</i></label>
<label class="form-label" for="authFile"><u>--auth-file</u></label>
<input type="text" id="authFile" class="form-control" placeholder="auth_file.key">
</div>
<h3>CSRF Tokens Control</h3>
<!-- --csrf-token -->
<div class="form-group">
<label class="form-label" for="csrfToken">ANTI-CSRF TOKEN FIEL<i tooltip="Option --csrf-token can be used to set the name of the hidden value that contains the randomized token.
This is useful in cases when web sites use non-standard names for such fields.">ⁱ</i></label>
<label class="form-label" for="csrfToken"><u>--csrf-token</u></label>
<input type="text" id="csrfToken" class="form-control" placeholder="anti-csrf">
</div>
<!-- --csrf-url -->
<div class="form-group">
<label class="form-label" for="csrfUrl">TOKEN EXTRACTION URL<i tooltip="Option --csrf-url can be used for retrieval of the token value from arbitrary URL address.
This is useful if the vulnerable target URL doesn't contain the necessary token value in the first place, but it is required to extract it from some other location.">ⁱ</i></label>
<label class="form-label" for="csrfUrl"><u>--csrf-url</u></label>
<input type="url" id="csrfUrl" class="form-control" placeholder="https://example.com/profile/">
</div>
<!-- --csrf-method -->
<div class="form-group">
<label class="form-label" for="csrfMethod">HTTP METHOD FOR TOKEN RETRIEVAL<i tooltip="HTTP method for token extraction.">ⁱ</i></label>
<label class="form-label" for="csrfMethod"><u>--csrf-method</u></label>
<select id="csrfMethod" class="form-control">
<option value="">-- Choose HTTP method --</option>
<option value="GET">GET</option>
<option value="POST">POST</option>
<option value="PUT">PUT</option>
<option value="DELETE">DELETE</option>
<option value="HEAD">HEAD</option>
<option value="OPTIONS">OPTIONS</option>
<option value="PATCH">PATCH</option>
<option value="custom">--Custom--</option>
</select>
<div class="form-group" id="customCsrfMethodGroup">
<input type="text" id="customCsrfMethod" class="form-control" placeholder="">
</div>
</div>
<!-- --csrf-retries -->
<div class="form-group">
<label class="form-label" for="csrfRetries">RETRIES DURING TOKEN RETRIEVAL<i tooltip="Retries for anti-CSRF token retrieval.
Default: 0">ⁱ</i></label>
<label class="form-label" for="csrfRetries"><u>--csrf-retries</u></label>
<input type="number" id="csrfRetries" class="form-control" placeholder="0" min="0" step="1">
</div>
</div>
</div>
</div>
</div>
<!-- INJECTION Tab -->
<div class="tab-content" id="injection">
<div class="card">
<div class="card__body">
<div class="form-grid">
<h3>Parameters</h3>
<!-- -p -->
<label class="form-group" for="paramTest">
<div class="form-label" >TESTABLE PARAMETERS<i tooltip="Comma separated parameters for testing. By default sqlmap tests all GET parameters and POST parameters.
When the value of --level is >= 2 it tests also HTTP Cookie header values. When this value is >= 3 it tests also HTTP User-Agent and HTTP Referer header value for SQL injections.
It is however possible to manually specify a comma-separated list of parameter(s) that you want sqlmap to test. This will bypass the dependence on value of --level too.
For instance, to test for GET parameter id and for HTTP User-Agent only, provide -p "id,user-agent".">ⁱ</i></div>
<div class="form-label" for="paramTest"><u>-p</u></div>
<input type="text" id="paramTest" class="form-control" placeholder="id,user-agent">
</label>
<!-- --skip -->
<label class="form-group" for="paramSkip">
<div class="form-label" >FORBIDDEN PARAMETERS<i tooltip="Skip testing for given parameter(s). That is especially useful in cases when you want to use higher value for --level and test all available parameters excluding some of HTTP headers normally being tested.
For instance, to skip testing for HTTP header User-Agent and HTTP header Referer at --level=5, provide --skip="user-agent,referer".">ⁱ</i></div>
<div class="form-label" for="paramSkip"><u>--skip</u></div>
<input type="text" id="paramSkip" class="form-control" placeholder="csrf_token,session_id">
</label>
<!-- --param-exclude -->
<label class="form-group" for="paramExclude">
<div class="form-label">FORBIDDEN PARAMETERS REGEX<i tooltip="Skip testing for given parameter(s). This is the same as --skip, but this switch is based on a regular expressions.
For instance, to skip testing for parameters which contain string token or session in their names, provide --param-exclude="token|session"">ⁱ</i></div>
<div class="form-label"><u>--param-exclude</u></div>
<input type="text" id="paramExclude" class="form-control" placeholder="token|session">
</label>
<!-- --param-filter -->
<label class="form-group" for="paramFilter">
<div class="form-label">PARAMETERS SCAN CATEGORY ALLOWLIST<i tooltip="The --param-filter parameter restrict scans to specific components of HTTP requests, improving efficiency and reducing noise.
Accepted comma-separated values include GET (URL parameters), POST (request body), COOKIE, HOST, USER-AGENT, and REFERER.
This switch can isolate high-risk areas like API endpoints (test only POST body parameters) or speed-up headers injection testing (specifying COOKIE,HOST,USER-AGENT,REFERER filter with --level=5 focuses scans on headers, ignoring GET/POST parameters).
The filter reduces scan times by 30-40% in header-rich environments and minimizes false positives from unnecessary parameters.">ⁱ</i></div>
<div class="form-label"><u>--param-filter</u></div>
<input type="text" id="paramFilter" class="form-control" placeholder="GET,POST,COOKIE,USER-AGENT...">
</label>
<!-- --prefix -->
<label class="form-group" for="prefix">
<div class="form-label">PREFIX TO PREPEND<i tooltip="The --prefix parameter allows you to prepend a custom string to every SQL injection payload before it is sent to the target application.
This parameter is essential when applications require specific SQL syntax or characters before the actual injection payload to construct a valid query.
It is particularly useful when dealing with applications that embed parameters within complex SQL queries requiring specific opening syntax, such as closing quotes or parentheses before the injection point.">ⁱ</i></div>
<div class="form-label"><u>--prefix</u></div>
<input type="text" id="prefix" class="form-control" placeholder="')">
</label>
<!-- --suffix -->
<label class="form-group" for="suffix">
<div class="form-label">SUFFIX TO APPEND<i tooltip="The --suffix parameter enables you to append a custom string to every SQL injection payload after the main injection code.
It is crucial when applications require specific closing characters or comments to prevent SQL syntax errors, such as SQL comments (--) or closing parentheses to maintain query validity.">ⁱ</i></div>
<div class="form-label"><u>--suffix</u></div>
<input type="text" id="suffix" class="form-control" placeholder="-- -">
</label>
<h3>Detection</h3>
<!-- --string -->
<label class="form-group" for="string">
<div class="form-label">TRUE DETECTION STRING<i tooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<div class="form-label"><u>--string</u></div>
<input type="text" id="string" class="form-control" placeholder="">
</label>
<!-- --regexp-->
<label class="form-group" for="regexp">
<div class="form-label">TRUE DETECTION REGEXP<i tooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<div class="form-label"><u>--regexp</u></div>
<input type="text" id="regexp" class="form-control" placeholder="">
</label>
<!-- --not-string -->
<label class="form-group" for="notString">
<div class="form-label">FALSE DETECTION STRING<i tooltip="By default the distinction of a True query from a False is done by comparing the injected requests page content with the original not injected page content.
Not always this concept works because sometimes the page content changes at each refresh even not injecting anything, for instance when the page has a counter, a dynamic advertisement banner or any other part of the HTML which is rendered dynamically and might change in time not only consequently to user's input.
The user can provide a string (--string option) which should be present on original page (though it is not a requirement) and on all True injected query pages, but that it is not on the False ones.
Instead of --string, the user can use a --regexp.
Alternatively, user can provide a --not-string option which should not present on original page and not on all True injected query pages, but appears always on False ones.">ⁱ</i></div>
<div class="form-label"><u>--not-string</u></div>
<input type="text" id="notString" class="form-control" placeholder="">
</label>
<!-- --code -->
<label class="form-group" for="code">
<div class="form-label">EXPECTED HTTP CODE<i tooltip="Use this in cases when you know that the distinction of a True query from a False one can be done using HTTP code.">ⁱ</i></div>
<div class="form-label"><u>--code</u></div>
<input type="number" id="code" class="form-control" min="100", max="599", step="1" placeholder="201">
</label>
<!-- --titles -->
<div class="form-group">
<label class="checkbox-label" for="titles">
<input type="checkbox" id="titles">
<b>DETECT COMPARING TITLES</b>
<u>--titles</u><i tooltip="Turn on when you knows that the distinction of a True query from a False one can be done using HTML title (e.g. "Welcome" for True and "Forbidden" for False).">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<!-- --text-only -->
<div class="form-group">
<label class="checkbox-label" for="textOnly">
<input type="checkbox" id="textOnly">
<b>FILTER ACTIVE CONTENT</b>
<u>--text-only</u><i tooltip="In cases with lot of active content (e.g. scripts, embeds, etc.) in the HTTP responses' body, you can filter pages (--text-only) just for their textual content.
This way, in a good number of cases, you can automatically tune the detection engine.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
<h3>Attack Optimalization</h3>
<!-- --level -->
<label class="form-group grid-span-2" for="level">
<div class="form-label">ATTACK <u>--level</u> <span id="levelValue">1</span></div>
<input type="range" id="level" class="slider" min="1" max="5" value="1">
<div class="additional-help" id="level-help">1: Show also information and warning messages (default).</div>
</label>
<!-- --risk -->
<label class="form-group grid-span-2" for="risk">
<div class="form-label">ATTACK <u>--risk</u> <span id="riskValue">1</span></div>
<input type="range" id="risk" class="slider" min="1" max="3" value="1">
<div class="additional-help" id="risk-help">1: Innocuous test for the majority of SQL injection points (default).</div>
</label>
<!-- --dbms -->
<label class="form-group" for="dbms">
<div class="form-label">FORCE TARGET DATABASE ENGINE<i tooltip="Greatly reduces scan time by minimalizing number of requests, using payloads appropriate only for the selected database engine.">ⁱ</i></div>
<div class="form-label"><u>--dbms</u></div>
<select id="dbms" class="form-control">
<option value="">Auto-detect</option>
<option value="MySQL">MySQL</option>
<option value="Oracle">Oracle</option>
<option value="PostgreSQL">PostgreSQL</option>
<option value="Microsoft SQL Server">Microsoft SQL Server</option>
<option value="Microsoft Access">Microsoft Access</option>
<option value="IBM DB2">IBM DB2</option>
<option value="SQLite">SQLite</option>
<option value="Firebird">Firebird</option>
<option value="Sybase">Sybase</option>
<option value="SAP MaxDB">SAP MaxDB</option>
<option value="Informix">Informix</option>
<option value="MariaDB">MariaDB</option>
<option value="Percona">Percona</option>
<option value="MemSQL">MemSQL</option>
<option value="TiDB">TiDB</option>
<option value="CockroachDB">CockroachDB</option>
<option value="HSQLDB">HSQLDB</option>
<option value="H2">H2</option>
<option value="MonetDB">MonetDB</option>
<option value="Apache Derby">Apache Derby</option>
<option value="Amazon Redshift">Amazon Redshift</option>
<option value="Vertica">Vertica</option>
<option value="Mckoi">Mckoi</option>
<option value="Presto">Presto</option>
<option value="Altibase">Altibase</option>
<option value="MimerSQL">MimerSQL</option>
<option value="CrateDB">CrateDB</option>
<option value="Greenplum">Greenplum</option>
<option value="Drizzle">Drizzle</option>
<option value="Apache Ignite">Apache Ignite</option>
<option value="Cubrid">Cubrid</option>
<option value="InterSystems Cache">InterSystems Cache</option>
<option value="IRIS">IRIS</option>
<option value="eXtremeDB">eXtremeDB</option>
<option value="FrontBase">FrontBase</option>
</select>
</label>
<!-- --os -->
<label class="form-group" for="os">
<div class="form-label">FORCE TARGET OS<i tooltip="By default sqlmap automatically detects the web application's back-end database management system underlying operating system when this information is a dependence of any other provided switch or option.
It is possible to force the operating system name by --os switch, if you already know it so that sqlmap will avoid doing it itself.
Note that this option is not mandatory and it is strongly recommended to use it only if you are absolutely sure about the back-end database management system underlying operating system.
If you do not know it, let sqlmap automatically identify it for you.">ⁱ</i></div>
<div class="form-label"><u>--os</u></div>
<select id="os" class="form-control">
<option value="">Auto-detect</option>
<option value="Linux">Linux</option>
<option value="Windows">Windows</option>
</select>
</label>
<!-- --second-url -->
<label class="form-group" for="secondUrl">
<div class="form-label">SECOND ORDER PAGE URL<i tooltip="Second-order SQL injection attack is an attack where result(s) of an injected payload in one vulnerable page is reflected at the other (e.g. frame).
You can point sqlmap a resulting page URL searched for second-order response to test for this type of SQL injection by using option --second-order.">ⁱ</i></div>
<div class="form-label"><u>--second-url</u></div>
<input type="url" id="secondUrl" class="form-control" placeholder="https://example.com/profile">
</label>
<!-- --second-req -->
<label class="form-group" for="secondReq">
<div class="form-label">SECOND ORDER REQUEST FILE<i tooltip="Second-order SQL injection attack is an attack where result(s) of an injected payload in one vulnerable page is reflected at the other (e.g. frame).
You can point sqlmap a request file for sending to the server where results are being shown to test by using option --second-req.">ⁱ</i></div>
<div class="form-label"><u>--second-req</u></div>
<input type="text" id="secondReq" class="form-control" placeholder="second-order-request.txt">
</label>
<!-- Attack techniques -->
<div class="form-group">
<span class="form-label checkbox-grid">ATTACK TECHNIQUES</span>
<div class="checkbox-grid">
<label class="checkbox-label" for="techB">
<input type="checkbox" id="techB" value="B">
<u>Boolean-based blind (B)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techE">
<input type="checkbox" id="techE" value="E">
<u>Error-based (E)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techU">
<input type="checkbox" id="techU" value="U">
<u>Union query-based (U)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techS">
<input type="checkbox" id="techS" value="S">
<u>Stacked queries (S)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techT">
<input type="checkbox" id="techT" value="T">
<u>Time-based blind (T)</u>
<span class="checkmark"></span>
</label>
<label class="checkbox-label" for="techQ">
<input type="checkbox" id="techQ" value="Q">
<u>Inline queries (Q)</u>
<span class="checkmark"></span>
</label>
</div>
</div>
<!-- Attack tuning -->
<div class="form-group">
<span class="form-label checkbox-grid">ATTACK TUNING</span>
<div class="checkbox-grid">
<!-- --invalid-bignum -->
<label class="checkbox-label" for="invalidBignum">
<input type="checkbox" id="invalidBignum">
<u>--invalid-bignum</u><i tooltip="This parameter forces sqlmap to use large integer numbers for invalidating original parameter values during SQL injection tests.
Instead of standard invalidation methods (e.g., negative values), sqlmap replaces original values with very large numbers, which can bypass application filters that block typical techniques.
It is particularly useful when applications filter standard parameter invalidation methods but may not properly handle extremely large numeric values.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --invalid-logical -->
<label class="checkbox-label" for="invalidLogical">
<input type="checkbox" id="invalidLogical">
<u>--invalid-logical</u><i tooltip="The switch enables the use of logical operations to invalidate parameter values.
Sqlmap replaces original values with logical expressions that always return false (e.g., id=(1=0)).
This method is effective when applications expect logical values or block other invalidation techniques.
The parameter serves as an alternative for standard invalidation methods in environments with advanced filtering mechanisms.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --invalid-string -->
<label class="checkbox-label" for="invalidString">
<input type="checkbox" id="invalidString">
<u>--invalid-string</u><i tooltip="This parameter causes sqlmap to use random character strings for parameter value invalidation. Sqlmap generates random strings instead of original values, bypassing application filters focused on numeric values.
It is useful when applications have special validation mechanisms for numbers but do not check string inputs.
The parameter automatically replaces parameters with random strings during boolean-based injection tests.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --no-cast -->
<label class="checkbox-label" for="noCast">
<input type="checkbox" id="noCast">
<u>--no-cast</u><i tooltip="The switch disables sqlmap's automatic payload casting mechanism.
Normally sqlmap adds CAST() functions to payloads for handling different DBMS data types.
Using --no-cast is necessary when applications have payload length restrictions or when casting functions are blocked by WAF.
It significantly reduces the size of generated payloads, which is critical in environments with character limits.
It is often combined with --no-escape in environments with query length restrictions where every character matters.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --no-escape -->
<label class="checkbox-label" for="noEscape">
<input type="checkbox" id="noEscape">
<u>--no-escape</u><i tooltip="This parameter disables sqlmap's built-in string escaping mechanism.
By default sqlmap automatically escapes special characters in payloads (adds backslash before apostrophes). This switch is useful when applications have their own escaping mechanisms or when automatic escaping breaks payloads.
It is often combined with --no-cast in environments with query length restrictions where every character matters.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --predict-output -->
<label class="checkbox-label" for="predictOutput">
<input type="checkbox" id="predictOutput">
<u>--predict-output</u><i tooltip="The switch enables a statistical algorithm for predicting query results in inference techniques.
Sqlmap builds statistical tables of most probable character values based on the txt/common-outputs.txt file and current enumeration knowledge.
It significantly speeds up data retrieval when values belong to common patterns (system table names, privileges).
The parameter is not compatible with --threads and works best when retrieving standard DBMS entities.">ⁱ</i>
<span class="checkmark"></span>
</label>
</div>
</div>
</div>
</div>
</div>
</div>
<!-- Exploitation Tab -->
<div class="tab-content" id="exploitation">
<div class="card">
<div class="card__body">
<div class="form-grid">
<!-- -D -->
<label class="form-group" for="database">
<div class="form-label">DATABASE(S) NAME FOR ENUMERATION<i tooltip="DBMS database to enumerate.">ⁱ</i></div>
<div class="form-label"><u>-D</u></div>
<input type="text" id="database" class="form-control" placeholder="database_name1,database_name2">
</label>
<!-- -T -->
<label class="form-group" for="table">
<div class="form-label">TABLE(S) NAME FOR ENUMERATION<i tooltip="DBMS database table(s) to enumerate.">ⁱ</i></div>
<div class="form-label"><u>-T</u></div>
<input type="text" id="table" class="form-control" placeholder="table_name1,table_name2">
</label>
<!-- -C -->
<label class="form-group" for="column">
<div class="form-label">COLUMN(S) NAME FOR ENUMERATION<i tooltip="DBMS database table column(s) to enumerate.">ⁱ</i></div>
<div class="form-label"><u>-C</u></div>
<input type="text" id="column" class="form-control" placeholder="column_name1,column_name2">
</label>
<!-- -X -->
<label class="form-group" for="exclude">
<div class="form-label">DBMS(S) TO NOT ENUMARATE<i tooltip="DBMS database identifier(s) to not enumerate.">ⁱ</i></div>
<div class="form-label"><u>-X</u></div>
<input type="text" id="exclude" class="form-control" placeholder="dbname">
</label>
<!-- -U -->
<label class="form-group" for="user">
<div class="form-label">USER NAME FOR ENUMERATION<i tooltip="DBMS user to enumerate (can be used with --roles and --passwords).">ⁱ</i></div>
<div class="form-label"><u>-U</u></div>
<input type="text" id="user" class="form-control" placeholder="username">
</label>
<!-- --pivot-column -->
<label class="form-group" for="pivotColumn">
<div class="form-label">PIVOT COLUMN NAME<i tooltip="Sometimes (e.g. for Microsoft SQL Server) it is not possible to dump the table rows straightforward by using OFFSET m, n mechanism because of lack of similar.
In such cases sqlmap dumps the content by determining the most suitable pivot column (the one with most unique values) whose values are used later on for retrieval of other column values.
If it is necessary to enforce the usage of particular pivot column because the automatically chosen one is not suitable (e.g. because of lack of table dump results) you can use option --pivot-column (e.g. --pivot-column=id).">ⁱ</i></div>
<div class="form-label"><u>--pivot</u></div>
<input type="text" id="pivotColumn" class="form-control" placeholder="column_name">
</label>
<!-- --where -->
<label class="form-group" for="where">
<div class="form-label">DUMP FILTER CONDITION<i tooltip="In case that you want to constraint the --dump to specific column values (or ranges) you can use option --where. Provided logical operation will be automatically used inside the WHERE clause.
For example, if you use --where=id>3 only table rows having value of column id greater than 3 will be retrieved (by appending WHERE id>3 to used dumping queries).">ⁱ</i></div>
<div class="form-label"><u>--where</u></div>
<input type="text" id="where" class="form-control" placeholder="SQL CONDITION">
</label>
<!-- --start -->
<label class="form-group" for="start">
<div class="form-label">DUMP STARTING ENTRY NUMBER<i tooltip="If you want to dump only a range of entries, then you can provide options --start and/or --stop to respectively start to dump from a certain entry and stop the dump at a certain entry.
For instance, if you want to dump only the first entry, provide --stop 1 in your command line. Vice versa if, for instance, you want to dump only the second and third entry, provide --start 1 --stop 3.">ⁱ</i></div>
<div class="form-label"><u>--start</u></div>
<input type="number" id="start" class="form-control" placeholder="1">
</label>
<!-- --stop -->
<label class="form-group" for="stop">
<div class="form-label">DUMP STOP ENTRY NUMBER<i tooltip="If you want to dump only a range of entries, then you can provide options --start and/or --stop to respectively start to dump from a certain entry and stop the dump at a certain entry.
For instance, if you want to dump only the first entry, provide --stop 1 in your command line. Vice versa if, for instance, you want to dump only the second and third entry, provide --start 1 --stop 3.">ⁱ</i></div>
<div class="form-label"><u>--stop</u></div>
<input type="number" id="stop" class="form-control" placeholder="3">
</label>
<!-- --first -->
<label class="form-group" for="first">
<div class="form-label">DUMP STARTING FROM THE N-TH CHARACTER<i tooltip="It is possible to specify which single character or range of characters to dump with options --first and --last.
For instance, if you want to dump columns' entries from the third to the fifth character, provide --first 3 --last 5. This feature only applies to the blind SQL injection techniques because for error-based and UNION query SQL injection techniques the number of requests is exactly the same, regardless of the length of the column's entry output to dump.">ⁱ</i></div>
<div class="form-label"><u>--first</u></div>
<input type="number" id="first" class="form-control" placeholder="3">
</label>
<!-- --last -->
<label class="form-group" for="last">
<div class="form-label">DUMP ENDING AT THE N-TH CHARACTER<i tooltip="It is possible to specify which single character or range of characters to dump with options --first and --last.
For instance, if you want to dump columns' entries from the third to the fifth character, provide --first 3 --last 5.
This feature only applies to the blind SQL injection techniques because for error-based and UNION query SQL injection techniques the number of requests is exactly the same, regardless of the length of the column's entry output to dump.">ⁱ</i></div>
<div class="form-label"><u>--last</u></div>
<input type="number" id="last" class="form-control" placeholder="5">
</label>
<!-- --sql-query -->
<label class="form-group" for="sqlQuery">
<div class="form-label">SQL STATEMENT FOR EXECUTION<i tooltip="SQL statement to be executed.">ⁱ</i></div>
<div class="form-label"><u>--sql-query</u></div>
<input type="text" id="sqlQuery" class="form-control" placeholder="SELECT 1 FROM DUAL">
</label>
<!-- --sql-file -->
<label class="form-group" for="sqlFile">
<div class="form-label">FILE WITH SQL STATEMENTS<i tooltip="SQL statement to be executed.">ⁱ</i></div>
<div class="form-label"><u>--sql-file</u></div>
<input type="text" id="sqlFile" class="form-control" placeholder="statements.sql">
</label>
<!-- ENUMERATION -->
<div class="form-group" style="grid-row-start: 1; grid-row-end: 6;">
<span class="form-label checkbox-grid">ENUMERATION AND DATA EXFILTRATION</span>
<div class="checkbox-grid">
<!-- --all -->
<label class="checkbox-label" for="all">
<input type="checkbox" id="all">
<u>--all</u><i tooltip="Retrieve everything.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --banner -->
<label class="checkbox-label" for="banner">
<input type="checkbox" id="banner">
<u>--banner</u><i tooltip="Retrieve DBMS banner.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --columns -->
<label class="checkbox-label" for="columns">
<input type="checkbox" id="columns">
<u>--columns</u><i tooltip="Enumerate DBMS database table columns.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --comments -->
<label class="checkbox-label" for="comments">
<input type="checkbox" id="comments">
<u>--comments</u><i tooltip="Check for DBMS comments during enumeration.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --count -->
<label class="checkbox-label" for="count">
<input type="checkbox" id="count">
<u>--count</u><i tooltip="Retrieve number of entries for table(s).">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --currentUser -->
<label class="checkbox-label" for="currentUser">
<input type="checkbox" id="currentUser">
<u>--current-user</u><i tooltip="Retrieve DBMS current user.">ⁱ</i>
<span class="checkmark"></span>
</label>
<!-- --currentDb -->
<label class="checkbox-label" for="currentDb">
<input type="checkbox" id="currentDb">
<u>--current-db</u><i tooltip="Retrieve DBMS current database.">ⁱ</i>