SQLMap Commands 2026: The Master Collection

[Blackhatpakistan]

Hey hackers — you searched sqlmap commands and got handed a GitHub wiki dump, a slideshare, a Medium post, and a cheat-sheet page buried under course upsells. This is the actual field guide: every command family organized in scannable tables (target, request, authentication, detection, techniques, tamper, extraction, optimization), plus the two things cheat sheets never include — how sqlmap actually works internally (its phases, so you understand what each flag drives) and tamper-script mechanics (why encoding transforms defeat signature filters and how to reason about picking one). Workflow section ties it to real recon-to-report flow, official project resources linked below, and the standing rules intact. Command reference that teaches the tool instead of listing it.

TL;DR: SQLMap is the open-source automatic SQL injection detection & exploitation tool (sqlmap.org) — it enumerates injection points, fingerprints the DBMS, and runs detection/extraction through configurable "techniques" (E=error, U=union, B=boolean, S=stacked, T=time-based, Q=inline). The command surface groups into eight families (below with tables): target selection, HTTP request config, authentication, detection tuning, technique/level/risk control, tamper transforms, extraction/output, and optimization. Understanding its phases (banner grab → fingerprint → injection enumeration → detection → exploitation → data) makes every flag meaningful instead of memorized. Resources: official site + GitHub repo (below). Rule: authorized scopes only — and never purchase CC or financial instruments from anyone.

What SQLMap Is (Internal Anatomy)​

Before the flags — what the tool actually does when it runs, because every command drives one of these phases:

Phase	What happens	Flags that control it
1. Banner grabbing	Server/tech stack identification from response headers and error behavior	-v (verbosity), --headers, --random-agent
2. DBMS fingerprint	Backend database identified (MySQL, MSSQL, PostgreSQL, Oracle, SQLite…) — everything downstream adapts to this	Automatic; --dbms= forces when detection errs
3. Injection enumeration	Injects test payloads across parameters to find injectable points and infer query structure (inline/subquery/stacked context)	--level, --risk, --testable-parameter, --skip
4. Detection techniques	Applies technique classes: Error-based, UniOn, Boolean-blind, Stacked, Time-based-blind, QUery-inline	--technique=EBUST, --banner, --flush-session
5. WAF/filter handling	Transforms payloads via tamper scripts, adjusts casing/encoding/comments	--tamper=, --space-probemark-style options, --skip-waf equivalents
6. Extraction & takeover	Dumps schemas/tables/columns/data; OS shell/file ops where DBMS and privileges allow	--dbs, --tables, --dump, --os-shell (authorization-critical territory)
7. Session/output	Results cached per session for resumption; verbose logging for reporting	--session-file, --output-dir, -v

Why the phases matter for command use: every flag either targets (phase 1-3 input), shapes detection (4-5 behavior), or harvests (6-7 output). When a run behaves unexpectedly — missed injection, false positive, stalled detection — the fix maps to a phase, which maps to a flag family. That's the difference between a practitioner who reads sqlmap's output and someone copy-pasting flags from a gist.

Command Family Reference: Target & Request​

Flag	Purpose	Example
-u "URL"	Single target URL with parameter	-u "https://target.com/page?id=1"
-m file	Bulk targets from file (one URL per line)	-m urls.txt
-l logfile	Targets from Burp/ZAP proxy log	-l traffic.log
-r request file	Load raw HTTP request (headers/cookies/body preserved)	-r request.txt
--data=	POST body data	--data "user=admin&id=1"
--cookie=	Session cookie for authenticated testing	--cookie "PHPSESSID=abc123"
--headers=	Custom headers block	--headers "Referer: ...\nX-Forwarded-For: ..."
--random-agent	Rotate User-Agent per request	--random-agent
--proxy=	Route through proxy (integration with the proxy guides on this site)	--proxy="http://127.0.0.1:8080"
--delay=	Seconds between requests (noise control)	--delay=3
--timeout= / --retries=	Request timing and retry behavior	--timeout=30 --retries=2

Command Family Reference: Detection & Techniques​

Flag	Purpose	Notes
--technique=	Enable technique classes: Error, UniOn, Boolean, Stacked, Time, Query-inline	Default EBUST — narrow to speed up (e.g., ET for error+time on slow targets)
--level= (1-5)	Test intensity — more parameters/payloads probed at higher levels	Level 1 = default; higher = more coverage, more noise
--risk= (1-3)	Aggressiveness — risk 2-3 adds payloads that could mutate data	Risk 3 on production = potential data damage — scope discipline required
--dbms=	Force DBMS (skip fingerprint)	When you already know the backend
--os=	Force OS detection for shell-related paths	Windows vs Linux behaviors differ downstream
--flush-session	Discard cached session (fresh test vectors)	Use after target changes or false results
--keep-alive	Connection reuse (speed on large jobs)	Pairs with --null-connection for specific checks
--string= / --not-string= / --regexp=	Custom true/false condition markers for boolean logic	When default heuristics misread page behavior
--text-only	Ignore page markup (compare pure text)	Noisy pages with heavy dynamic content

Command Family Reference: Tamper Scripts​

Tamper scripts transform payloads pre-send to slip past signature filters — the mechanics most "lists" skip:

Tamper	Transform	Defeats
space2comment	Replaces spaces with SQL comments (/**/)	Space-based keyword/regex filters
randomcase	Randomizes SELECT/FROM keyword casing per request	Case-sensitive signature matching
chardoubleencode	Double URL-encoding of characters	Single-decode WAF layers (payload survives one unwrap)
between	> → BETWEEN rewrites	Operator-pattern filters
percentage	Prefixes random % before keywords	Keyword-boundary regexes
unionalltounion	UNION SELECT → UNION ALL SELECT variants	Basic UNION signature lists
sleep2blank	Time-function syntax variants	Time-based-payload filters
symboliclogical	AND/OR → &&/|| rewrites	Boolean-keyword filters

The reasoning framework: read the WAF/filter's rejection behavior (which responses block?), identify WHICH layer objects (keyword list? encoding? spacing?), pick tampers that mutate that layer specifically, and test incrementally (--tamper=one → verify → stack). Tamper = --tamper=space2comment,randomcase (comma-stacking works; each script chains in order). The full script directory lives in sqlmap's official repo (tamper/ folder — linked below): study the source of scripts you use — they're ~10-line transforms each, and reading them teaches more evasion-theory than any article.

Command Family Reference: Extraction & Output​

Flag	Purpose	Note
--dbs	List databases	First reconnaissance step on a confirmed injection
--tables	List tables (current or -D target)	Schema mapping stage
--columns	List columns for -T table	Before any dump decision
--dump / --dump-all	Dump table data / everything accessible	The line where recon becomes data access — authorized scope only
-D/-T/-C	Scope DB/table/column precisely	Never dump-wide when scoped works
--search	Search column names across schema	Needle-finding without full enumeration
--count	Row counts without dumping	Assessment-stage option
--output-dir=	Save results to directory	Reporting hygiene: evidence in files, not terminal scrollback
-v 3+	Verbosity (payloads/traffic shown)	Debugging detection problems — see exactly what's injected

The Workflow: Recon → Report​

Where commands fit in the bigger flow (pairs with the SQL injection dorks guide's recon-to-report section):

• Scope first. Written authorization, rules of engagement, target boundaries — the tools don't care but the law and the engagement do. Everything below assumes this exists.
• Discovery (dorks → endpoints). Use the recon-dorks pair to map parameter surfaces before sqlmap touches anything — targeted testing beats blind crawling.
• Baseline request. Capture one clean request per endpoint type (-r request.txt from Burp or manual), preserving auth/headers — sqlmap testing realistic traffic, not naked requests that behave differently than real users'.
• Detection-first runs. Start conservative: --technique=E (error) with default level/risk → confirm injectability with minimum noise. Escalate techniques only where needed (Boolean → Time on quieter channels).
• Scoped extraction. Schema map (--dbs --tables --columns) BEFORE data decisions; dump only what the engagement's evidence requirements specify.
• Document as you go. --output-dir + session files + your own notes: which endpoint, which technique, which flags worked — the report writes itself from that log instead of archaeology at deadline.

Spoiler: Advanced flags: the power tier

Flags that matter once basics are automatic:

Request realism: --second-order=URL (test injections triggered via second-order flows — data stored now, executed later), --crawl=3 (lightweight crawling to discover linked endpoints within scope), --ignore-links (bound crawling to seed), --form (parse and test forms from the target page automatically).

Detection edge cases: --skip=参数 (exclude specific parameters — e.g., ones that break your session), --mobile (mobile-UA behavior), --host= / --referer= (header spoofing for hosts that validate), --base64 (handle base64-encoded parameter wrappers — common in custom frameworks).

Concurrency (careful): --threads exists but sqlmap is deliberately single-threaded by design for injection safety — bulk work goes through -m/listing files instead. The tool's philosophy: correctness over speed, because injection is not a throughput problem.

Session persistence: --session-file= per target — resumes interrupted enumerations without re-testing (faster AND quieter: no duplicate payload waves). Pair with --flush-session when the target changes state.

Harvest automation: --dump-format=CSV for machine-readable output, --techniques= narrowed per-endpoint as you learn each target's behavior — the workflow's optimization loop is re-running smarter, not bigger.

Common Mistakes & Detection Traps​

• Default settings against filtered targets. Running default flags at a WAF and reading rejections as "not injectable" — detection is phase-appropriate: verify WAF presence first (response codes on obvious probes), configure tamper/level, THEN test. The tool tells you what it's doing with -v 3 — read the payloads it sends.
• Noise on shared infrastructure. High level+risk floods test payloads that trigger rate-limiting, lockouts, or SOC alerts on production. On anything real: conservative start, escalate per-endpoint — the workflow section's sequence exists because blast-first burns access.
• Ignoring false positives. Boolean detection misreads pages with dynamic content — confirm with --string/--regexp custom conditions or --text-only before believing a hit. One unverified "injectable" contaminates the whole engagement report.
• Skipping request realism. Testing bare URLs without session/auth headers where real traffic carries them — the app behaves differently unauthenticated, and "no injection" conclusions lie. -r with a captured request is the default for anything behind login.
• Extraction beyond scope. --dump-all on a scoped engagement = collecting data you weren't authorized for. The engagement letter defines evidence, not the tool's capabilities — every phase-6 flag carries the authorization weight of the ROE.

SQLMap doesn't replace knowledge of injection — it automates the mechanics of someone who already understands it. The practitioners who get value read the payloads with -v 3 and know WHY each technique fires; the ones who burn access treat flags like lottery tickets. The tool is honest about what it does; return the favor by reading its output.

FAQ​

Is SQLMap free?​

Yes — sqlmap is free and open-source (GPL license), developed publicly on GitHub by the sqlmapproject team, with official documentation at sqlmap.org. Both links are in the resources section below. Beware third-party "premium sqlmap" repackagings — they're the malware-wrapped downloads the nulled-economy guides on this site document; the official repo IS the only legitimate source.

Is using SQLMap illegal?​

The tool is legal software (like a lockpick set: legal to own, context defines use). Running it against systems without written authorization is unauthorized access under computer-misuse laws regardless of tool intent — the tool changes nothing about permission. Legitimate contexts: your own infrastructure, bug-bounty scopes with written rules, contracted assessments, educational labs. The workflow section's step-one isn't a formality — it's the legal boundary every flag after it depends on.

What's the difference between the technique classes?​

Six classes (the --technique letters): Error-based (database errors leak data directly — fastest when available), UniOn (query-merging to pull data into visible responses), Boolean-blind (true/false inference through page-behavior differences — slow, no direct output), Time-based-blind (delay-inference when even boolean differences are hidden — slowest), Stacked (additional statements executed after the original — powerful, often blocked), Query-inline (in-band via inline subqueries). Default EBUST; narrowing to what the target supports speeds runs and cuts noise.

Why do my sqlmap runs fail against sites that look injectable?​

Common stack: (1) WAF filtering payloads — check response patterns, apply targeted tampers (tamper table); (2) unauthenticated testing against logged-in-only behavior — use -r with captured requests; (3) false-negative detection — raise --level, add techniques (time-based for hard targets), define custom true/false markers; (4) dynamic pages confusing boolean logic — --text-only or --string anchors. Diagnose with -v 3: read what's actually being sent and returned before changing flags.

What are sqlmap tamper scripts and when do I need them?​

Small transform scripts (sqlmap's tamper/ directory) that rewrite payloads before transmission — space→comments, case randomization, encoding layers, operator rewrites — to slip past signature/regex WAF rules. Needed when your detection runs get rejected with consistent payload-shaped blocks. Selection logic: identify WHICH filter layer rejects (keyword? spacing? encoding?), pick tampers that mutate that layer (the tamper table maps this), stack with commas, test incrementally. They're evasion of SIGNATURES, not of authorization — scope rules still govern everything.

SQLMap vs manual SQL injection testing?​

Complementary, not opposed: manual testing builds the understanding (query structure, DBMS behavior, blind-inference logic) that lets you interpret sqlmap's output correctly and spot what it misses (business-logic flaws, second-order contexts, multi-step flows). SQLMap handles the mechanical enumeration/technique-application that would take hours manually. The strongest workflow uses manual recon to define targets (the dorks guides' mapping) and sqlmap for systematic testing within that map — with your judgment on every escalation decision.

Where To Go From Here​

You've got the internal anatomy (phases → flag families), command tables across four families, tamper mechanics with selection reasoning, the recon-to-report workflow, the advanced power-tier spoiler, common traps, and the FAQ. Reference that teaches — bookmark it, use the tables, and read -v 3 output like the log it is.

Official resources (the legitimate shelf):

• sqlmap.org — official documentation: every flag documented authoritatively (usage page is the ground truth for anything this guide summarizes)
• github.com/sqlmapproject/sqlmap — the only legitimate source: releases, the tamper/ directory (study those scripts — they're the evasion curriculum), and issue tracker where technique behavior gets discussed publicly
• PortSwigger Web Security Academy — SQL Injection — the free lab environment for building injection understanding before pointing tools at anything (the knowledge layer beneath the mechanics)

BlackSec official channel: t.me/Blacksec_official — drops, tradecraft, community. Only official channel we run — "premium sqlmap forks" sold in DMs are the malware-wrapped download economy every guide here dissects.

Related reading + boards:

• SQL Injection Dorks: The 2026 Master Collection — the recon half: finding injectable surfaces before sqlmap runs
• Google Dorks List — general recon grammar (the dork series pair)
• Hacking Tools — this guide's home board: tool mechanics, workflows, comparisons
• Courses — the underlying skills: SQL query logic, DBMS internals, why each detection technique exists

Standing rules: authorized scope before any run (the workflow's step one — non-negotiable), and never purchase CC or financial instruments from anyone — the cracked-"premium" tool market and the card market share the same sellers, the same exit scams, and the same buyer-predation economics. The official repo is free; that's not a coincidence.

— BlackSec crew. Command surface current for sqlmap 1.x (official docs are the ground truth — when flags change between releases, sqlmap.org wins over any retelling, including this one). Re-read the tamper directory periodically; the script list grows as filters evolve.